cPanel EUVD-2026-51572

The attack requires that the cPanel deployment uses a front-end proxy (e.g., a load balancer or reverse proxy) in front of the cPanel backend application server, with both components speaking HTTP/1.1 and disagreeing on request boundary parsing (the AT:P prerequisite). A victim user must make an HTTP request through the same connection or pipeline during the attacker's timing window (UI:P - passive interaction). No authentication is required from the attacker (PR:N). Exploitation is limited by the AT:P condition (specific server configuration and timing alignment required) and the UI:P condition (victim must organically submit a request). Single-server deployments with no front-end proxy, or deployments exclusively using HTTP/2 end-to-end, are not susceptible to classic CL/TE desync.

The NVD CVSS 4.0 score of 5.6 (Medium) somewhat undersells the potential real-world impact in multi-tenant deployments. The vector AV:N/AC:L/AT:P/PR:N/UI:P reflects that exploitation is network-based with no authentication required, but is gated by attack-specific prerequisites (AT:P) and passive user interaction (UI:P) - meaning a victim must send a request through the affected stack within an attacker-controlled timing window. The subsequent-system metrics SC:H/SI:H are the most alarming signals: they indicate that a successful smuggle crosses into another user's request context, enabling credential interception or session hijacking affecting parties other than the attacker. No EPSS data was provided in the source intelligence. The absence of a CISA KEV entry and no reported POC lowers immediate urgency, but the nature of the flaw (cross-tenant credential exposure in shared hosting) warrants prioritized patching for any internet-facing cPanel deployment. The wildcard CPE versions suggest all pre-patch releases are affected; no conflicting signals were detected between the CVSS vector and the description.

An attacker on the internet sends a specially crafted HTTP request with ambiguous Content-Length and Transfer-Encoding headers to a shared cPanel hosting server; the front-end proxy and back-end application parse the boundary differently, causing the attacker's payload to be prepended to the next request submitted by a different tenant user. When that victim user authenticates or submits a form containing credentials, those credentials are captured within the attacker's smuggled response or request context. No public proof-of-concept code has been identified at time of analysis, but the technique is well-documented in the broader HTTP smuggling literature.