CVE-2026-41473
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending requests to /api/ai-scanner/status-webhook and /api/ai-scanner/callback. Attackers can exploit the lack of authentication checks to cause denial of service through storage exhaustion, corrupt scan history records, and pollute database fields with malicious data.
Risk Assessment
The vulnerability could lead to service disruption, data corruption, and database integrity compromise, potentially affecting trust in the system.
Recommendation
Upgrade CyberPanel to version 2.4.5 or later immediately and restrict API access to trusted networks only.
Original NVD description (English source)
CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending requests to the /api/ai-scanner/status-webhook and /api/ai-scanner/callback endpoints. Attackers can exploit the lack of authentication checks to cause denial of service through storage exhaustion, corrupt scan history records, and pollute database fields with malicious data.