CVE-2026-41473
CyberPanel < 2.4.4 Unauthenticated API Access via AI Scanner Endpoints
Vexday Risk Score
41Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 8.8EPSS 0.8%KEV nãoPoC públicaNuclei —Metasploit —Patch referenciado
Lifecycle
24 Apr 2026Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
CyberPanel versions prior to 2.4.4 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending requests to the /api/ai-scanner/status-webhook and /api/ai-scanner/callback endpoints. Attackers can exploit the lack of authentication checks to cause denial of service through storage exhaustion, corrupt scan history records, and pollute database fields with malicious data.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
usmannasir · cyberpanelpublic PoCs found — 1
cve_referenceitsrez.re/post/cyberpanel-rceunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →