CyberPanel Pre-Auth RCE Chain Exploits AI Scanner Flaws for Server Shell Access
A critical vulnerability chain in CyberPanel versions prior to 2.4.4 allows unauthenticated attackers to gain full server shell access by exploiting flaws in the AI Scanner functionality.
A severe pre-authentication Remote Code Execution (RCE) chain has been discovered in the popular web hosting control panel, CyberPanel. Versions prior to 2.4.4 are vulnerable, allowing attackers to gain complete server shell access without needing any credentials. This exploit chain, identified by Pentera researchers, leverages a combination of stored cross-site scripting (XSS) within the AI Scanner feature and the abuse of unauthenticated API endpoints, ultimately leading to command execution.
CyberPanel is a widely used platform for managing web hosting environments, including websites, DNS, email, and databases. Its role as a central control plane makes a compromise particularly impactful, granting attackers extensive control over hosted servers and the data they contain. The vulnerability chain highlights how seemingly minor weaknesses can be chained together to achieve a critical system takeover.
The attack begins with a stored XSS vulnerability, tracked as CVE-2026-41472, found in CyberPanel's AI Scanner. This flaw arises because the platform's AI Scanner endpoint, designed to receive scan data, stores user-controlled input without adequate sanitization. An attacker can inject malicious JavaScript into a forged scan result, but this script does not execute immediately. It lies dormant until a CyberPanel administrator views the compromised AI Scanner results page.
To trigger the stored XSS, attackers first need a valid scan_id. This requirement is met by exploiting another vulnerability, CVE-2026-41473. Researchers discovered an unauthenticated API endpoint, /api/ai-scanner/list-api-keys, which exposes information about recent AI scans, including valid scan identifiers. By accessing this endpoint, an attacker can obtain the necessary scan_id to proceed with the exploit chain.
Once a valid scan_id is obtained, the attacker injects malicious JavaScript into a forged scan result. When an administrator later accesses the AI Scanner results, the injected script executes within the administrator's authenticated browser session. Leveraging the administrator's active session and CSRF token, the script can perform actions on their behalf. Pentera researchers demonstrated that this could be used to silently create a new administrative account within CyberPanel, granting the attacker direct access to the control panel.
The final stage of the attack involves abusing CyberPanel's cron job management feature. With the newly created administrative privileges, the attacker can set up a website and associated system user. They then exploit the cron job functionality to execute arbitrary commands on the server. The cronCommand parameter, in particular, was found to be susceptible to shell command execution due to insufficient security filtering of special characters.
Pentera reported these vulnerabilities to CyberPanel on May 4, 2026. The CyberPanel team responded swiftly, issuing patches within approximately four hours. The fixes included removing debug endpoints, enforcing authentication for callback functionalities, and implementing proper output escaping. Administrators are strongly urged to update their CyberPanel installations to the latest patched version immediately.
Organizations unable to patch immediately can mitigate the risk by disabling the AI Scanner feature and restricting access to the vulnerable API endpoints (/api/ai-scanner/list-api-keys and /api/ai-scanner/test-auth) until updates can be applied. This vulnerability chain serves as a stark reminder of how multiple, individually less severe flaws can combine to create a critical pathway for attackers to gain deep access to sensitive server environments.