CVE-2026-41473: CyberPanel Unauthenticated API Access via AI Scanner Endpoints
CyberPanel contains a missing-authentication flaw (CWE-306) in AI Scanner worker API endpoints that lets unauthenticated remote parties write arbitrary data to the database. The record describes possible denial of service through storage exhaustion, corruption of scan history, and database field pollution. No confirmed exploitation in the wild appears in the sources consulted, and the CVE is not listed in CISA KEV.
Overview
CyberPanel is a web hosting control panel. This record describes missing authentication checks on AI Scanner worker API endpoints, classified as CWE-306 (Missing Authentication for Critical Function). According to the record, unauthenticated remote parties can send requests that write data into the database.
Impact
- Unauthenticated writes to database records, as described in the record.
- Possible denial of service through storage exhaustion.
- Possible corruption of scan history records and pollution of database fields with malicious data.
- The NVD base score is 9.1. The record notes network reachability, no privileges required, no user interaction, and high integrity and availability impact.
Affected products and versions
- Product recorded as Cyberpanel Cyberpanel: listed as before 2.4.4.
- Product recorded as Usmannasir Cyberpanel: listed as before 2.4.5.
- The two entries use different endpoints, so the exact affected boundary should be confirmed against the vendor commit and the advisory before relying on either one alone.
Exploitation status
- The record shows KEV listed as false. No confirmed exploitation in the wild appears in the sources consulted.
- The SSVC data in the record marks exploitation as proof-of-concept and automatable as yes, which is an assessment of exploitability, not evidence of attacks.
- The EPSS probability is 0.01052 with a percentile of 0.64047, as recorded.
Remediation and mitigation
- Update CyberPanel to a release that includes the vendor fix. The record links a patch commit in the upstream repository and lists the fix as a version boundary at 2.4.5.
- Until the update is applied, restrict network access to the panel and its AI Scanner endpoints to trusted sources.
- Review the database for unexpected records in scan history and related tables after any suspected exposure.
Detection guidance
- Review web server and application logs for requests to AI Scanner endpoints from unexpected or unknown sources.
- Monitor unusual growth in scan history or storage tables, which may indicate storage exhaustion.
- Compare scan history records against known-good backups to identify corrupted or injected entries.
Limitations of the available information
- The record does not state the exact fixed version. The commit and the third-party advisory were not reviewed in full for this analysis.
- The two affected entries list different version boundaries, and the record does not explain the difference.
- The EPSS date in the record is later than the publication date, so its timing should be interpreted with care.
- No exploit details are provided here, by design.
Frequently asked questions
Which CyberPanel versions are affected?
The record lists Cyberpanel Cyberpanel as before 2.4.4 and Usmannasir Cyberpanel as before 2.4.5. The two ranges differ, so confirm the boundary against the vendor commit before relying on one.
Is this vulnerability being actively exploited?
The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. SSVC data marks exploitation as proof-of-concept, which describes exploitability only.
What is the main risk?
The record describes unauthenticated database writes that can lead to storage exhaustion, denial of service, corrupted scan history, and polluted database fields.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.