Reported by 2 outlets
CyberPanel Pre-Auth RCE Flaws Let Attackers Gain Remote Server Access
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.57 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
CyberPanel Pre-Auth RCE Flaws Let Attackers Gain Remote Server Access
gbhackers.com · 54d ago · August 20th, 2026
Researchers have revealed a pre-authentication remote code execution (RCE) vulnerability chain in CyberPanel that could allow an internet-based attacker to execute commands on vulnerable servers without any credentials. This attack combines exposed AI Scanner interfaces, an authentication flaw tracked as CVE-2026-41473, stored cross-site scripting (XSS) tracked as CVE-2026-41472, and CyberPanel’s built-in cron-job functionality. CyberPanel is […] The post CyberPanel Pre-Auth RCE Flaws Let Attackers Gain Remote Server Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
CyberPanel Flaws Chain Authentication Bypass and Stored XSS Into Remote Code Execution
cyberpress.org · 54d ago · August 20th, 2026
A newly disclosed chain of pre-authentication remote code execution vulnerabilities in CyberPanel could enable unauthenticated attackers to compromise exposed servers. The attack, named ShadowPanel by Pentera researcher Nir Chako, combines weaknesses in the platform’s AI Scanner componen t with its built-in cron-job functionality to move from unauthenticated access to host-level command execution. CyberPanel is a web hosting control panel for managing websites, DNS configurations, email accounts, databases, users, and scheduled tasks. CyberPanel Flaws Chain Authentication Bypass A successful compromise is therefore especially significant because the software operates as an administrative layer over services hosted on a server. An attacker with control-panel privileges can potentially alter websites, create user accounts, access databases, and establish persistent access. The ShadowPanel chain affects CyberPanel version 2.4 and relies on multiple weaknesses that are more dangerous together than individually. The initial stage targets exposed AI Scanner interfaces. Researchers found that unauthenticated debug API routes, including /api/ai-scanner/list-api-keys , could disclose information about recent scan activity. RCE chain (Source: pentera) This information included valid scan identifiers, known as scan_id values. These identifiers are central to the attack because CyberPanel’s AI Scanner callback mechanism requires a valid scan ID before accepting scan results. Once an atta