PenteraIO Exploits and Proofs of Concept

Showing 4 PoCs on this page

GitHub

PenteraIO/CVE-2026-41473-CyberPanel-AI-Scanner-Unauth

Repository PoC0Created 2026-06-21ScannerCVE-2026-414733 files

7.3 KiB

Analysisdeepseek-v4-pro:cloud · 2026-08-10

Technical assessment

A Nuclei template that detects CVE-2026-41473, an authentication bypass in CyberPanel AI Scanner API endpoints. It sends unauthenticated GET and POST requests and matches on response status codes and body content to confirm vulnerability without performing any exploitation or write operations.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Nuclei detection template for CVE-2026-41473. The template sends two HTTP requests to a target to detect an authentication bypass vulnerability. No backdoor, deceptive payload, or concealed operator-directed harm is present. The template's behavior is limited to standard vulnerability detection: a GET request to list API keys and a POST request with an empty body to probe the callback endpoint. No persistence, credential exfiltration, unrelated remote access, or hidden payloads are observed.

ClassificationScanner

Model confidence100%

AuthenticationNot required

LanguagesYAML

Target softwareCyberPanel

Attack typesauthentication_bypassinformation_disclosure

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Nuclei detection template. It sends HTTP requests and matches on response characteristics to identify vulnerable instances. It does not perform any write, modification, or exploitation of the target. The POST request uses an empty body specifically to avoid performing a real write, as stated in the README.

README.md:31-32cyberpanel-aisscanner-unauth-rw-cve-2026-41473.yaml:1

Requirements

Target must be a CyberPanel instance with the AI Scanner feature enabled.README.md:29
Target must be running a CyberPanel version prior to 2.4.4.README.md:7

Observed behavior

Sends an unauthenticated GET request to /api/ai-scanner/list-api-keys and checks for HTTP 200, JSON content type, and specific JSON keys (api_keys, recent_scans, is_payment_configured).cyberpanel-aisscanner-unauth-rw-cve-2026-41473.yaml:32-53
Sends an unauthenticated POST request to /api/ai-scanner/callback with an empty JSON body and checks for HTTP 400 or 404, JSON content type, and the presence of 'scan_id' in the response body.cyberpanel-aisscanner-unauth-rw-cve-2026-41473.yaml:80-105
Extracts admin usernames, API key prefixes, hosted domain names, and scan IDs from the GET response if the vulnerability is detected.cyberpanel-aisscanner-unauth-rw-cve-2026-41473.yaml:55-78

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Request: Payload withheldProbes the read endpoint to confirm unauthenticated access and extract data.cyberpanel-aisscanner-unauth-rw-cve-2026-41473.yaml:32-34
Network Request: Payload withheldProbes the write endpoint with an empty body to confirm authentication is bypassed without performing a real write.cyberpanel-aisscanner-unauth-rw-cve-2026-41473.yaml:80-85

Review boundaries

What the analysis did not establish

One file (LICENSE) is omitted from the text content; its metadata is present but content is not provided.
The evidence does not include the execution output of the template, only its source code.
One unclassified file (1064 bytes) was present in the repository but not included as text; its content was not analyzed. The file metadata does not suggest it is an executable or script, and it is not referenced by the provided template or README.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub