CVE-2026-87820 in CyberPanel
Summary
by MITRE • 09/09/2026
CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity to inventory multi-tenant installations and facilitate follow-on attacks.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
CyberPanel versions 2.4.3 through 2.4.5 contain a critical information disclosure vulnerability within their AI Scanner module, specifically affecting debugging endpoints that were inadvertently left exposed in production builds. These endpoints are accessible without any form of authentication or authorization checks, allowing unauthenticated remote attackers to interact with the system's internal diagnostic tools. The flaw stems from improper access control configurations where sensitive administrative interfaces intended for development and testing purposes remain active and reachable over standard network protocols. This misconfiguration effectively bypasses the security boundaries designed to protect administrator credentials and operational data within the multi-tenant hosting environment managed by CyberPanel.
The technical impact of this vulnerability is significant as it allows attackers to enumerate critical system metadata that facilitates further malicious activities. Specifically, the exposed endpoints disclose administrator usernames, which provides a targeted list of high-value accounts for subsequent brute-force or credential stuffing attacks. Additionally, the disclosure of API-key prefixes enables attackers to potentially reconstruct valid authentication tokens if combined with other leaked data or through offline cracking efforts, depending on the key generation algorithm's strength. The exposure of scan identifiers and target domains allows adversaries to map out the infrastructure managed by a specific CyberPanel instance, revealing which websites are hosted and actively being scanned for vulnerabilities. This reconnaissance capability is particularly dangerous in multi-tenant environments where one compromised account or exposed data point can lead to lateral movement across multiple customer sites.
From an operational perspective, this vulnerability undermines the confidentiality integrity of the hosting platform's administrative layer. Attackers can use the gathered intelligence to profile administrators and understand the security posture of the organization by analyzing recent scanner activity logs. This information aids in crafting more effective social engineering campaigns or targeted exploits against specific services identified as targets. The exposure of account metadata further compounds the risk by providing contextual data that may assist in bypassing additional security controls such as two-factor authentication if recovery codes or backup methods are linked to the exposed accounts.
This vulnerability aligns with CWE-200, which classifies information exposure through error conditions or misconfigured systems, and falls under MITRE ATT&CK technique T1087, Account Discovery, where adversaries enumerate user accounts on a local network or system. To mitigate this risk, administrators of CyberPanel instances within the affected version range should immediately upgrade to a patched release that removes or properly secures these debugging endpoints. If upgrading is not immediately feasible, it is critical to restrict access to the AI Scanner module via firewall rules or reverse proxy configurations, ensuring that only authorized internal IP addresses can reach these diagnostic interfaces. Regular audits of exposed administrative interfaces and strict adherence to secure development lifecycle practices are essential to prevent similar misconfigurations in future releases.