Which versions of CyberPanel are affected by CVE-2026-41473?

CyberPanel deployments prior to version 2.4.4 expose unauthenticated endpoints that allow remote attackers to write arbitrary data to the database, directly compromising the integrity of security…. A patch is available.

Is there a public PoC exploit available for CVE-2026-41473?

Yes, a public proof-of-concept exploit is available for CVE-2026-41473. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-41473?

Within 24 hours, identify all CyberPanel instances running versions before 2.4.4 and restrict network access to the vulnerable endpoints (/api/ai-scanner/status-webhook and /api/ai-scanner/callback) using firewall or WAF rules as an interim control. Within 7 days, upgrade all affected CyberPanel installations to version 2.4.4 or later, prioritizing internet-facing deployments. Within 30 days, verify that all instances have been patched to version 2.4.4 or later, audit scan-history records for unauthorized database modifications occurring during the exposure window, and formally document remediation completion.

CyberPanel CVE-2026-41473

Q: What is the CVSS score of CVE-2026-41473?

CVE-2026-41473 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-25631 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-04-24 VulnCheck

Denial Of Service Authentication Bypass Cyberpanel

8.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Unauthenticated network endpoint with no user interaction (AV:N/AC:L/PR:N/UI:N); no data disclosure so C:N, but arbitrary DB writes and storage-exhaustion DoS give I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 02:20 vuln.today

Analysis Generated

Jul 24, 2026 - 02:20 vuln.today

PoC Detected

Apr 28, 2026 - 15:44 vuln.today

Public exploit code

CVSS changed

Apr 24, 2026 - 21:22 NVD

8.8 (HIGH)

EUVD ID Assigned

Apr 24, 2026 - 21:00 euvd

EUVD-2026-25631

Patch released

Apr 24, 2026 - 21:00 nvd

Patch available

CVE Published

Apr 24, 2026 - 20:40 nvd

HIGH 8.8

DescriptionCVE.org

CyberPanel versions prior to 2.4.4 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending requests to the /api/ai-scanner/status-webhook and /api/ai-scanner/callback endpoints. Attackers can exploit the lack of authentication checks to cause denial of service through storage exhaustion, corrupt scan history records, and pollute database fields with malicious data.

AnalysisAI

Unauthenticated database writes in CyberPanel versions before 2.4.4 allow remote attackers to abuse two AI Scanner worker endpoints (/api/ai-scanner/status-webhook and /api/ai-scanner/callback) that ship without authentication checks (CWE-306). Because no credentials are required (CVSS 4.0 PR:N/UI:N), any attacker who can reach the panel can flood the database, corrupt scan-history records, and pollute stored fields, degrading integrity and availability. Publicly available exploit code exists and the flaw was reported by VulnCheck, though EPSS remains low at 0.21% and it is not listed in CISA KEV.

Technical ContextAI

CyberPanel is an open-source web hosting control panel (Django/Python based, per the plogical/acl.py and websiteFunctions/website.py source paths) used to manage web servers, DNS, email, and domains. The root cause is CWE-306, Missing Authentication for a Critical Function: the AI Scanner worker API routes that receive status webhooks and callbacks were intended for trusted internal/worker communication but were exposed to the network without an authentication or ownership check. The CPE cpe:2.3:a:usmannasir:cyberpanel confirms the affected product is Usman Nasir's CyberPanel application. The vendor fix in commit 0a099b1b adds a default-deny ownership return (return 0) in checkOwnership and hardens related domain-fetch logic, consistent with closing an access-control gap where the code previously fell through without denying the request.

RemediationAI

Vendor-released patch: upgrade to CyberPanel 2.4.4 or later, which includes fix commit 0a099b1b193946555fbdd387a28486b1521f9961 (https://github.com/usmannasir/cyberpanel/commit/0a099b1b193946555fbdd387a28486b1521f9961) that adds the missing ownership/authentication enforcement. Until you can patch, restrict or block network access to the /api/ai-scanner/status-webhook and /api/ai-scanner/callback endpoints at a reverse proxy or WAF, and limit the panel's management interface to trusted source IPs or a VPN - the trade-off is that legitimate AI Scanner worker callbacks may break, so verify scanner functionality after applying such filtering. Monitor database size and scan-history tables for anomalous growth to detect storage-exhaustion attempts. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/cyberpanel-unauthenticated-api-access-via-ai-scanner-endpoints) for details.