CVE-2026-71965: CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature
CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in the remote backup feature that allows authenticated attackers to gain root-level SSH access by supplying a malicious remote server address. Attackers can exploit the unverified SSH public key retrieval process to write an attacker-controlled public key directly to /root/.ssh/authorizedkeys, granting persistent root access to the host system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CyberPanelto a version that resolves this vulnerability.Fixed in 2.4.3Patch eca0c3c - Compensating control
Mitigate the root-level SSH persistence risk from the unverified SSH public key retrieval process by blocking or restricting any interaction that would trigger unverified retrieval/write to /root/.ssh/authorized_keys (e.g., prevent untrusted hosts from reaching the affected retrieval/remote-backup server address path via network controls/ACLs).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71965?
CVE-2026-71965 has a high severity rating of 8.8.
How do I fix CVE-2026-71965?
To fix CVE-2026-71965, upgrade to CyberPanel version 2.4.4 or later.
What type of vulnerability is CVE-2026-71965?
CVE-2026-71965 is an authenticated remote code execution vulnerability.
Who can exploit CVE-2026-71965?
Authenticated attackers can exploit CVE-2026-71965 to gain root-level SSH access.
What feature of CyberPanel does CVE-2026-71965 affect?
CVE-2026-71965 affects the remote backup feature of CyberPanel.