CyberPanel CVE-2026-87820

The AI Scanner module endpoints in CyberPanel 2.4.3-2.4.5 require no authentication and accept unauthenticated HTTP requests from any network-reachable source; no special configuration, user interaction, or account credentials are needed. Exploitation requires only network access to the CyberPanel web interface (typically TCP port 8090) and the presence of the AI Scanner feature, which is bundled with affected versions by default. Exploitation is limited to instances where the CyberPanel port is directly reachable by the attacker; deployments protected by a firewall, VPN, or IP allowlist restricting panel access to trusted networks are not exposed to external exploitation. Version 2.4.6 and later are not affected.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) accurately represents the exposure: unauthenticated, low-complexity network access yielding partial confidentiality impact with no integrity or availability consequence. The disclosed data - admin usernames, API-key prefixes, scan IDs, and hosted domain names - is high-value reconnaissance material that meaningfully enables follow-on attacks such as credential stuffing or targeted phishing against panel administrators. No EPSS score was provided in the input, so exploitation probability must be inferred; the trivial unauthenticated HTTP access pattern makes opportunistic automated scanning plausible, though KEV absence and no reported POC indicate exploitation has not been widespread or confirmed. Risk is highest for multi-tenant hosting providers where a single CyberPanel instance manages many domains and administrator accounts; single-site self-hosted deployments face narrower but still material exposure since admin username enumeration lowers the barrier to brute-force attacks.

An unauthenticated attacker sends HTTP POST requests to /aiscanner/scan-callback/ or /aiscanner/receive-status-update/ on a public-facing CyberPanel 2.4.3-2.4.5 instance, receiving JSON responses containing administrator usernames, partial API keys, scan identifiers, and hosted domain names without any credentials. Armed with this enumerated account data, the attacker launches targeted credential-stuffing or phishing campaigns against the identified administrators, seeking to escalate from reconnaissance to full panel compromise and access to all hosted sites.