PT-2026-35084 · Unknown · Cyberpanel

Djibril Mounkoro · Published 2026-04-24 · Updated 2026-05-21 · CVE-2026-41473

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions CyberPanel versions prior to 2.4.4

Description An authentication bypass in the AI Scanner worker API endpoints allows unauthenticated remote attackers to write arbitrary data to the database. This is achieved by sending requests to the endpoints '/api/ai-scanner/status-webhook' and '/api/ai-scanner/callback'. Exploitation of this flaw can lead to denial of service through storage exhaustion, corruption of scan history records, and pollution of database fields with malicious data.

Recommendations Update to version 2.4.4 or later.

Exploit

Fix

DoS

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-41473

Affected Products

Cyberpanel

References · 10

• 🔥 https://itsrez.re/post/cyberpanel-rce · Exploit
• https://github.com/usmannasir/cyberpanel/commit/0a099b1b193946555fbdd387a28486b1521f9961 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41473 · Security Note
• https://twitter.com/lyrie_ai/status/2057424009931714563 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2047823499612324088 · Twitter Post
• https://twitter.com/lyrie_ai/status/2057424009092792642 · Twitter Post
• https://twitter.com/lyrie_ai/status/2057424008073658816 · Twitter Post
• https://twitter.com/CVEnew/status/2047798552416694388 · Twitter Post
• https://vulncheck.com/advisories/cyberpanel-unauthenticated-api-access-via-ai-scanner-endpoints · Note
• https://twitter.com/NewsNerdie/status/2048462710052958529 · Twitter Post