Critical severity · published Apr 24, 2026
CVE-2026-41473
CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints
9.1
CVSS
0.8%
EPSS
No
On KEV
Description
CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending requests to the /api/ai-scanner/status-webhook and /api/ai-scanner/callback endpoints. Attackers can exploit the lack of authentication checks to cause denial of service through storage exhaustion, corrupt scan history records, and pollute database fields with malicious data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CY
cyberpanel · usmannasir
before 2.4.5 · source: vendor, NVD
Affected product
CY
cyberpanel
usmannasir
More from cyberpanel
9.8
CVE-2026-67614
CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal
8.8
CVE-2026-71966
CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer
8.8
CVE-2026-71965
CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature
8.8
CVE-2026-65917
CyberPanel IncBackups IDOR via Sequential Backup ID
8.1
CVE-2026-65916
CyberPanel Missing Authorization in cancelBackupCreation Handler