CVE-2026-71965: 
Cyberpanel vulnerability analysis and mitigation

CVE-2026-71965 is an authenticated remote code execution (RCE) vulnerability in CyberPanel 2.4.3's remote backup feature that allows authenticated attackers to gain persistent root-level SSH access to the host system. By supplying a malicious remote server address, an attacker can exploit the unverified SSH public key retrieval process to write an attacker-controlled public key directly to /root/.ssh/authorized_keys. The vulnerability was published on August 10, 2026, and is fixed in commit eca0c3c. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-345 (Insufficient Verification of Data Authenticity): CyberPanel's remote backup feature accepted user-supplied remote server addresses and passed them unsanitized into shell commands (e.g., rsync over SSH), without validating or verifying the authenticity of the SSH public key retrieved from the remote host. Because StrictHostKeyChecking=no was used in the SSH invocation, an attacker-controlled server could present a malicious public key that CyberPanel would then write to /root/.ssh/authorized_keys, granting the attacker persistent root SSH access. The patch (commit eca0c3c) introduced input validation via ACLManager.commandInjectionCheck(), IP/hostname format regex checks, and shlex.quote() wrapping for all user-controllable parameters passed into shell commands (GitHub Commit, GitHub Advisory). A secondary CWE-78 (OS Command Injection) classification is also applicable given the unsanitized input passed to shell commands (Feedly).

Successful exploitation grants the attacker persistent root-level SSH access to the host system, resulting in complete compromise of confidentiality, integrity, and availability. An attacker with root access can exfiltrate all hosted data (including website files, databases, and credentials), modify or destroy system configurations, install backdoors or malware, and pivot to other systems on the same network. All websites, services, and data managed by the CyberPanel instance are at risk (GitHub Advisory, Feedly).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability requires low-privilege authentication (any valid CyberPanel account), making it accessible to a broad range of potential attackers. The EPSS score is approximately 0.345% (27th percentile), indicating a relatively low but non-negligible probability of exploitation in the near term. No threat actor attribution or CISA KEV catalog listing has been reported at this time (GitHub Advisory).

1. Reconnaissance: Identify internet-facing CyberPanel 2.4.3 instances using tools like Shodan or Censys, searching for CyberPanel login pages (typically on port 8090).
2. Obtain credentials: Acquire any valid CyberPanel user account (low-privilege accounts are sufficient). This could be via credential stuffing, phishing, or use of a free/trial account if available.
3. Set up a malicious SSH server: On an attacker-controlled server, configure an SSH server that presents an attacker-controlled public key as part of the host key exchange. Generate an SSH key pair (ssh-keygen -t rsa -f attacker_key) and configure the server to serve this key.
4. Trigger the remote backup feature: Authenticate to CyberPanel and navigate to the remote backup destination creation feature. Supply the attacker-controlled server's IP address as the remote backup destination.
5. Exploit unverified key retrieval: Because CyberPanel uses StrictHostKeyChecking=no in its SSH invocation, it will automatically accept and write the attacker's public key to /root/.ssh/authorized_keys on the CyberPanel host during the SSH handshake/key exchange process.
6. Achieve persistent root access: Use the corresponding private key to SSH directly into the CyberPanel host as root: ssh -i attacker_key root@<cyberpanel-host>, gaining full system control (GitHub Advisory, GitHub Commit).

• File System: Unauthorized or unexpected entries in /root/.ssh/authorized_keys — particularly newly added public keys not belonging to known administrators; new or modified files in /root/.ssh/.
• Logs: CyberPanel application logs showing remote backup destination creation requests with unusual or external IP addresses; SSH daemon logs (/var/log/auth.log or /var/log/secure) showing successful root logins from unknown IP addresses or using key-based authentication from unexpected sources.
• Network: Outbound SSH connections from the CyberPanel host to unknown external IP addresses initiated by the CyberPanel process; inbound SSH connections to port 22 from unfamiliar IP addresses authenticating as root.
• Process: Unexpected rsync or ssh processes spawned by the CyberPanel Python process (/usr/local/CyberCP/bin/python) connecting to external hosts not previously seen in backup configurations (GitHub Commit, GitHub Advisory).

Apply the security patch immediately by updating CyberPanel to a version containing commit eca0c3c or later, which introduces input validation and shlex.quote() sanitization for all user-supplied parameters in the remote backup feature (GitHub Commit). Until patching is complete, restrict access to the remote backup feature to trusted administrators only, or disable it entirely if not in use. Additionally, audit /root/.ssh/authorized_keys for unauthorized entries, review CyberPanel user accounts and apply least-privilege principles, and consider restricting CyberPanel's management interface to trusted IP ranges via firewall rules (GitHub Advisory, Feedly).

The vulnerability was assigned by VulnCheck and published to the GitHub Advisory Database on August 10, 2026. A technical write-up was published by the researcher at themcsam.github.io detailing the CyberPanel 2.4.3 vulnerabilities, and VulnCheck published an advisory covering the authenticated RCE via the remote backup feature. No significant broader media coverage or notable social media reactions have been identified at this time (GitHub Advisory, VulnCheck Advisory).