CVE-2026-41473

Critical

Description

CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending requests to the /api/ai-scanner/status-webhook and /api/ai-scanner/callback endpoints. Attackers can exploit the lack of authentication checks to cause denial of service through storage exhaustion, corrupt scan history records, and pollute database fields with malicious data.

SeverityCritical

CVSS9.1

Exploit probability—

ProductCyberpanel

PublishedApr 24, 2026

First seenApr 24, 2026

Weakness typeCWE-306Missing authentication for critical function

How to fix

Update

cyberpanel cyberpanel2.4.4 or later

Patches

github.com/usmannasir/cyberpanel/commit/8eb29181cb137baa4adb4bba5dce60f601d55a5f

Affected products

Product	Affected versions	Fixed in
cyberpanel cyberpanel	v < 2.4.4	2.4.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.