CyberPanel EUVD-2026-58129

The only prerequisite is network reachability of the CyberPanel WebTerminal FastAPI SSH service on TCP port 8888 in a version before 3.0.0; exploitation uses a JWT forged with the application's hard-coded signing secret and the claim ssh_user=root, requiring no valid account, no user interaction, and no prior foothold. What limits exploitation is purely exposure: if port 8888 is firewalled off from untrusted networks, restricted to a management VLAN/VPN, or the WebTerminal feature is disabled, an external attacker cannot reach the vulnerable endpoint. There is no version-specific quirk or non-default configuration needed - default installations exposing the service are directly exploitable.

This should be treated as a top-priority, drop-everything issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scoring 9.3 aligns cleanly with the description: network-reachable, low complexity, no privileges, no user interaction, and full compromise of confidentiality, integrity and availability - an unauthenticated path to root. Unlike many high-CVSS findings that are gated by unusual preconditions, there is no mitigating condition here beyond network reachability of port 8888, and the 'secret' is not secret because it is hard-coded in open-source code. EPSS and CISA KEV data were not provided in the input, so I cannot cite an exploitation-probability figure or confirmed in-the-wild use; the absence of a KEV listing here reflects missing input data, not evidence of safety. Given the trivial forge-a-token mechanics, even a mid-sized municipal IT team in opole running a single exposed CyberPanel node should treat this as urgent and patch immediately rather than wait for exploitation telemetry. The realistic worst case - full server takeover of a hosting control plane and every site it manages - dominates any argument for deferral.

An attacker scans the internet for CyberPanel hosts with TCP 8888 open, then uses the publicly known hard-coded JWT secret to sign a token containing ssh_user=root. They open a WebSocket to the WebTerminal service, present the forged token, and are dropped into an interactive root shell with no credentials required - from which they exfiltrate data, deploy malware, or pivot to every website the panel manages. No public exploit is identified at time of analysis, but no user interaction or authentication stands in the way.