CVE-2026-87820: CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner
CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity to inventory multi-tenant installations and facilitate follow-on attacks.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
CyberPanel versions 2.4.3 through 2.4.5 are affected. The exposed AI Scanner debugging endpoints are accessible without authentication.
What can an unauthenticated attacker obtain?
An attacker can disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. They can also enumerate panel administrators and recent AI Scanner activity.
Does exploitation require credentials or user interaction?
No. The reported vector is network-accessible, requires no privileges, and requires no user interaction.
How can this information be used by an attacker?
The disclosed data can help inventory multi-tenant installations and identify administrators, domains, and recent scanner activity. This may facilitate follow-on attacks.