Dateline: August 20, 2026
No Password Required: New CyberPanel RCE Chain Reaches the Server
Researchers just showed how a chain of minor flaws in a popular hosting control panel adds up to something ugly. No password. No stolen login. An attacker on the internet could walk from an open scanner endpoint all the way to running commands on the server.
What Happened?
Pentera researcher Nir Chako disclosed a pre-authentication RCE chain in CyberPanel and gave it a name: ShadowPanel. It hits CyberPanel version 2.4, the control panel that runs websites, DNS, email, databases, and scheduled tasks for countless small hosts.
The clever part is that no single bug does the damage. Three weaknesses stack together.
First comes an exposed debug route in the AI Scanner. An endpoint like /api/ai-scanner/list-api-keys answered without any login and handed back valid scan IDs.
Next is CVE-2026-41473, missing authentication in the AI Scanner worker endpoints. With a valid scan ID, an attacker could push forged scan results straight into the database through the callback endpoints.
Those forged results carried a payload. That sets up CVE-2026-41472, a stored cross-site scripting flaw. When an admin opened the poisoned scan results, the hidden script ran inside their browser session. Instead of making noise, it quietly used that session to create a brand new admin account.
From there the attacker had panel access. The last step abused CyberPanel’s own cron job feature, which runs commands by design, to fire off a reverse shell. Game over.
Pentera reported the full chain on May 4, 2026. CyberPanel patched it in roughly four hours by removing the debug endpoints, adding callback authentication, and escaping output properly.
What’s the Impact?
A control panel is not just another app. It sits above every site, database, and mailbox on the box. Take the panel, and you take everything under it.
CyberPanel has a rough history here. Back in 2024, a separate flaw let attackers hit more than 22,000 instances with PSAUX ransomware, and nearly all of them dropped offline. So the pattern is familiar, and the stakes are real.
The ShadowPanel research is a proof of concept from a security firm, not a confirmed mass attack. But the recipe is public now. Exposed endpoints, a stored script, and a feature built to run commands are all an attacker needs.
CyberPanel ShadowPanel Chain — Hunting Signals
CVE-2026-41473 + CVE-2026-41472 · Affects CyberPanel 2.4 · Patch available
Why no hashes or IPs? ShadowPanel was disclosed by researchers as a proof of concept. There is no confirmed in-the-wild campaign, no public proof-of-concept payload, and no file hashes, C2 IPs, or domains released. The reliable signals are the specific endpoints and the behavior each stage leaves behind. Hunt for the diagnostic indicators below and patch first.
Endpoints to Watch and Restrict
Exposed debug route (stage 1)
/api/ai-scanner/list-api-keys answering without authentication. Also restrict /api/ai-scanner/test-auth.
Unauthenticated callback endpoints (stage 2)
/api/ai-scanner/status-webhook
/api/ai-scanner/callback — used to write forged scan data into the database.
Behavioral Signals by Stage
Suspicious AI Scanner callbacks
Scan result submissions from unexpected sources, or callbacks that do not match a scan your team actually started.
Scan results that changed on their own
AI Scanner findings that were altered with no matching activity. May carry the stored XSS payload (stage 3).
Newly created admin accounts
CyberPanel administrator accounts that appear without a request. The chain creates one via the admin’s own session (stage 4).
Unauthorized cron jobs
Scheduled tasks nobody created, especially ones with unusual cronCommand values. This is the RCE and reverse-shell step (stage 5).
Exposure & Version
Reduce the attack surface
If you cannot patch immediately, disable the AI Scanner feature and keep the management panel off the open internet behind an allowlist.
Affected release
CyberPanel 2.4. Update to the latest patched release. The fix removed debug endpoints, added callback authentication, and added output escaping.
If You Find a Match
Preserve panel and web server logs · remove rogue admin accounts and cron jobs · isolate the affected server · rotate credentials and session material · treat as a full server compromise · engage incident response. Patching does not remove an attacker who is already resident.
How to Avoid This
Patch first. Update CyberPanel to the latest fixed release right away.
If you cannot patch this minute, shrink the target. Turn off the AI Scanner feature. Block access to the debug routes /api/ai-scanner/list-api-keys and /api/ai-scanner/test-auth. Keep the management panel off the open internet and behind an allowlist.
Then go hunting. Check logs for odd AI Scanner callbacks, scan results that changed when nobody touched them, admin accounts you did not create, and cron jobs nobody scheduled. Any one of those is a red flag worth chasing.
