CVE-2026-87820: CyberPanel Information Disclosure Flaw

CVE-2026-87820 Overview

CVE-2026-87820 is an information disclosure vulnerability in CyberPanel versions 2.4.3 through 2.4.5. The flaw exposes unauthenticated AI Scanner debugging endpoints that leak administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Attackers can query these endpoints without credentials to enumerate panel administrators and recent scanner activity. This reconnaissance enables inventory of multi-tenant CyberPanel installations and facilitates follow-on attacks against exposed accounts. The weakness is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can enumerate administrator accounts, API-key prefixes, and scan metadata across CyberPanel deployments, providing reconnaissance data for subsequent credential attacks or targeted exploitation.

Affected Products

CyberPanel 2.4.3
CyberPanel 2.4.4
CyberPanel 2.4.5

Discovery Timeline

2026-09-09 - CVE CVE-2026-87820 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87820

Vulnerability Analysis

The vulnerability resides in the CyberPanel AI Scanner module, specifically in aiScanner/api.py and aiScanner/status_api.py. These modules expose HTTP endpoints intended for scanner callback and status reporting operations. The endpoints lack authentication controls and return sensitive metadata directly in responses. An unauthenticated remote attacker can query these endpoints across the network and receive administrator usernames, API-key prefixes, scan identifiers, and target domains associated with active or historical scans.

The disclosed data supports systematic reconnaissance. Attackers can build inventories of tenants hosted on shared CyberPanel infrastructure and correlate administrator identifiers with API-key prefixes. This information reduces the cost of follow-on credential-stuffing, targeted phishing, or exploitation of authenticated attack surface.

Root Cause

The root cause is missing authentication and authorization on debugging endpoints that were intended for internal scanner coordination. The AI Scanner callback and status routes did not enforce administrator session checks. The patch introduces the AIScannerSettings model into the callback and status modules, enabling proper authentication of callback requests and correct output escaping.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends HTTP requests to the exposed AI Scanner endpoints on any reachable CyberPanel instance running an affected version. The endpoints respond with JSON containing administrator usernames, API-key prefixes, and scan metadata that should not be disclosed to unauthenticated clients.

python

# Patch excerpt: aiScanner/api.py
 from django.views.decorators.http import require_http_methods
 from websiteFunctions.models import Websites
 from loginSystem.models import Administrator
-from .models import FileAccessToken, ScanHistory
+from .models import AIScannerSettings, FileAccessToken, ScanHistory
 from plogical.CyberCPLogFileWriter import CyberCPLogFileWriter as logging

# Patch excerpt: aiScanner/status_api.py
 from django.views.decorators.csrf import csrf_exempt
 from django.views.decorators.http import require_http_methods
 from django.utils import timezone
+from .models import AIScannerSettings, ScanHistory
 from .status_models import ScanStatusUpdate
 from plogical.CyberCPLogFileWriter import CyberCPLogFileWriter as logging

Source: GitHub Commit 20484fd. The fix wires the AIScannerSettings model into the callback and status handlers so authentication and escaping can be enforced.

Detection Methods for CVE-2026-87820

Indicators of Compromise

Unauthenticated HTTP GET or POST requests to AI Scanner API paths under /aiScanner/ from external IP addresses.
Web server access logs showing responses containing administrator usernames or apiKey prefix fields to unauthenticated clients.
Anomalous scanner status queries originating from IP addresses that do not match legitimate management sources.

Detection Strategies

Inspect CyberPanel access logs for requests to aiScanner/api and aiScanner/status_api endpoints that return HTTP 200 without a valid administrator session cookie.
Correlate outbound reconnaissance patterns targeting multiple CyberPanel hosts across a subnet, indicating enumeration of multi-tenant installations.
Monitor for subsequent authentication attempts using administrator usernames that were previously exposed via scanner endpoint responses.

Monitoring Recommendations

Forward CyberPanel web server logs to a centralized log platform and alert on unauthenticated hits against aiScanner routes.
Track response payload sizes and content types on scanner endpoints; sudden spikes suggest enumeration activity.
Alert on repeated failed logins that immediately follow successful scanner endpoint queries from the same source IP.

How to Mitigate CVE-2026-87820

Immediate Actions Required

Upgrade CyberPanel to the fixed version that includes commit 20484fd1786a424054386e5d6290d66b47cab3a3 or later.
Restrict access to the CyberPanel management interface to trusted management networks using firewall rules or reverse-proxy allowlists.
Rotate any API keys whose prefixes may have been exposed through the AI Scanner endpoints.
Audit administrator accounts for signs of targeted authentication attempts and enforce strong password and MFA policies.

Patch Information

The vulnerability is addressed in the upstream CyberPanel repository via commit 20484fd1786a424054386e5d6290d66b47cab3a3, which corrects AI scanner callback authentication and output escaping. Refer to the GitHub Security Advisory GHSA-qmwq-9cc8-x6h2 and the VulnCheck Advisory on CyberPanel for coordinated disclosure details.

Workarounds

Block external access to /aiScanner/ URL paths at the reverse proxy or web server layer until the patch is applied.
Disable the AI Scanner module in CyberPanel configuration if it is not required for operational needs.
Place the CyberPanel management port behind a VPN or IP allowlist to prevent unauthenticated internet access to any administrative endpoints.

bash

# Nginx example: block unauthenticated access to AI Scanner endpoints
location ~* ^/aiScanner/ {
    allow 10.0.0.0/8;      # trusted management network
    deny all;
    proxy_pass http://cyberpanel_backend;
}