CVE-2026-41315 is a critical unauthenticated remote command execution flaw (CVSS 9.8) in the mdserver-web Linux panel, versions 0.18.0 to 0.18.4. Two cron related endpoints skip authentication. The advisory lists no patched version, so restrict network access to the panel now and watch for a release.
What's affected
The GitHub advisory for the Python project mdserver-web lists v0.18.0 through v0.18.4, the latest at the time of the advisory, and shows no patched version. The record names two interfaces without authentication: /modify_crond and /start_task.
How to check if you're exposed
Find where the panel runs and which version it is, usually shown in the panel footer or in the project's version file. Then check who can reach its port. A panel on a public IP with the default port reachable from anywhere is exposed.
Look at the scheduled tasks list in the panel and in the system crontab for entries you did not create. The advisory says attackers can edit the default built-in scheduled tasks, so check those first.
What to do now
- Block public access to the panel with a firewall rule or security group, and allow only a VPN or a fixed admin address.
- Check the project's releases for a fixed version, and upgrade as soon as one exists.
- Review scheduled tasks and system cron for unexpected commands, and remove them.
- If you find changed tasks, treat the server as compromised: rotate credentials and review it before returning it to service.
- Consider whether you need a web panel on this server at all.
Why it matters
The record lists CWE-78, OS command injection, and CWE-862, missing authorization. A scheduled task feature is by design a way to run commands. Without an authorization check on the endpoint that edits and starts tasks, anyone who can reach it can run what they like.
Server panels are attractive targets because they hold broad control by design, and many sit on the open internet. When a project has no patch, network level controls are the only real defense. The record does not flag this CVE as known exploited.
Quick check
Can I fix this by changing the panel port?
That only hides it. Restrict access with a firewall or VPN, and apply a fix when one ships.
Sources
Last reviewed: 19 October 2026.
