CVE-2026-41473: Critical Missing Auth in CyberPanel AI Scanner API

CVE-2026-41473 is a critical missing authentication flaw (CVSS 9.1) in CyberPanel before 2.4.5. Two AI Scanner worker endpoints accept writes from anyone, which can fill storage, corrupt scan history and pollute database fields. Upgrade to 2.4.5.

What's affected

Per the record and the VulnCheck advisory, CyberPanel versions before 2.4.5 are affected. The two endpoints named are /api/ai-scanner/status-webhook and /api/ai-scanner/callback. The VulnCheck advisory scores it 8.8 where NVD gives 9.1.

How to check if you're exposed

Check the version in the CyberPanel dashboard or from the install directory. If it is below 2.4.5 and the panel is reachable from the internet, you are exposed.

Look at the web server access log for requests to the two AI Scanner paths from addresses you do not control, and check disk usage on the database volume for sudden growth.

What to do now

1. Upgrade CyberPanel to 2.4.5 or later.
2. Restrict access to the panel's port to your admin addresses with a firewall.
3. Review the AI Scanner scan history for odd records, and clean them up.
4. Check the database volume size and clear any junk that built up.
5. Keep CyberPanel on a regular update schedule, since the project has had several auth related fixes.

Why it matters

The record lists CWE-306, missing authentication for a critical function. The NVD description says the impact is denial of service by storage exhaustion, corrupted scan history and polluted database fields.

An itsrez.re post, which the record links, covers other CyberPanel issues and notes that the project's security middleware lets whole path prefixes skip session checks. That pattern, an allowlist of paths that bypass auth, is where this class of bug tends to appear. Use per-route checks rather than prefix rules. The record does not flag this CVE as known exploited.

Quick check

Sources

• VulnCheck advisory for CyberPanel
• itsrez write-up on CyberPanel

Last reviewed: 19 October 2026.