CyberPanel EUVD-2026-58130

Exploitation requires valid CyberPanel administrator credentials - the CVSS 4.0 PR:H metric confirms this is an authenticated-only vulnerability. Unauthenticated remote attackers and low-privileged users cannot reach the vulnerable cloudAPI ReadReport endpoint. The target must be running CyberPanel prior to version 3.0.0 with the cloudAPI endpoint network-accessible (AV:N per CVSS). No special non-default configuration beyond having an administrator account is required. The primary factor limiting exploitation is the administrator authentication barrier; the secondary limiting factor is that the vulnerability is read-only - there is no code execution or write primitive (VI:N, VA:N in the CVSS vector), so an attacker cannot directly modify files or execute commands through this flaw alone, though exfiltrated private keys enable further attack steps.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N reflects an accurate picture: network-exploitable with high confidentiality impact, but gated behind administrator authentication (PR:H). This authentication requirement is the dominant mitigating factor - the attack surface is limited to users who already possess valid admin credentials. However, the practical risk escalates considerably in multi-tenant hosting environments, where a single compromised CyberPanel admin account can yield SSH private keys and JWT secrets for all hosted domains, enabling lateral movement well beyond what admin-panel access alone would normally allow. No EPSS score or KEV listing was provided in the intelligence data, so exploitation probability and active exploitation status cannot be quantified; these are unknown. No public POC has been identified. The CVSS vector is internally consistent with the description - AV:N matches the network-accessible endpoint, PR:H matches the administrator-only requirement, and the pure confidentiality impact (VC:H/VI:N/VA:N) aligns with a read-only file disclosure primitive. No conflicting signals were identified.

An attacker who has acquired CyberPanel administrator credentials - via phishing, credential stuffing against a reused password, or insider access - authenticates to the admin panel and submits a crafted JSON POST to the cloudAPI ReadReport endpoint with a reportFile value such as ../../../../root/.ssh/id_rsa. CyberPanel's root-privileged process opens the file and returns its contents in the response, allowing the attacker to harvest private SSH keys and use them to pivot to any server accessible via those credentials. No public proof-of-concept has been identified, but the exploitation path requires only standard HTTP tooling.