CVE-2026-41473

HIGH

CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-41473 has a selected CVSS score of 8.8 (high); EIP currently links 1 repository PoC.

Description

CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending requests to the /api/ai-scanner/status-webhook and /api/ai-scanner/callback endpoints. Attackers can exploit the lack of authentication checks to cause denial of service through storage exhaustion, corrupt scan history records, and pollute database fields with malicious data.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 27, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

cyberpanel

Browse usmannasir / cyberpanel

Default status: unaffected

CVE ListBefore 2.4.5affected
8eb29181cb137baa4adb4bba5dce60f601d55a5funaffected

Proofs of concept

1

Repository PoCs

GitHubPenteraIO/CVE-2026-41473-CyberPanel-AI-Scanner-UnauthRepository PoCby PenteraIO0Scanner3 files

7.3 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Nuclei template that detects CVE-2026-41473, an authentication bypass in CyberPanel AI Scanner API endpoints. It sends unauthenticated GET and POST requests and matches on response status codes and body content to confirm vulnerability without performing any exploitation or write operations.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Nuclei detection template for CVE-2026-41473. The template sends two HTTP requests to a target to detect an authentication bypass vulnerability. No backdoor, deceptive payload, or concealed operator-directed harm is present. The template's behavior is limited to standard vulnerability detection: a GET request to list API keys and a POST request with an empty body to probe the callback endpoint. No persistence, credential exfiltration, unrelated remote access, or hidden payloads are observed.

ClassificationScanner
Model confidence100%
AuthenticationNot required
LanguagesYAML
Target softwareCyberPanel
Attack typesauthentication_bypassinformation_disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Nuclei detection template. It sends HTTP requests and matches on response characteristics to identify vulnerable instances. It does not perform any write, modification, or exploitation of the target. The POST request uses an empty body specifically to avoid performing a real write, as stated in the README.

README.md:31-32cyberpanel-aisscanner-unauth-rw-cve-2026-41473.yaml:1

Requirements

  • Target must be a CyberPanel instance with the AI Scanner feature enabled.README.md:29
  • Target must be running a CyberPanel version prior to 2.4.4.README.md:7

Observed behavior

  • Sends an unauthenticated GET request to /api/ai-scanner/list-api-keys and checks for HTTP 200, JSON content type, and specific JSON keys (api_keys, recent_scans, is_payment_configured).cyberpanel-aisscanner-unauth-rw-cve-2026-41473.yaml:32-53
  • Sends an unauthenticated POST request to /api/ai-scanner/callback with an empty JSON body and checks for HTTP 400 or 404, JSON content type, and the presence of 'scan_id' in the response body.cyberpanel-aisscanner-unauth-rw-cve-2026-41473.yaml:80-105
  • Extracts admin usernames, API key prefixes, hosted domain names, and scan IDs from the GET response if the vulnerability is detected.cyberpanel-aisscanner-unauth-rw-cve-2026-41473.yaml:55-78
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Request
GET {{BaseURL}}/api/ai-scanner/list-api-keysProbes the read endpoint to confirm unauthenticated access and extract data.cyberpanel-aisscanner-unauth-rw-cve-2026-41473.yaml:32-34
Network Request
POST {{BaseURL}}/api/ai-scanner/callback with body {}Probes the write endpoint with an empty body to confirm authentication is bypassed without performing a real write.cyberpanel-aisscanner-unauth-rw-cve-2026-41473.yaml:80-85
Review boundaries

What the analysis did not establish

  • One file (LICENSE) is omitted from the text content; its metadata is present but content is not provided.
  • The evidence does not include the execution output of the template, only its source code.
  • One unclassified file (1064 bytes) was present in the repository but not included as text; its content was not analyzed. The file metadata does not suggest it is an executable or script, and it is not referenced by the provided template or README.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

5