CVE-2026-87820— CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner
Quick assessment
Affected
usmannasir cyberpanel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
CyberPanel 2.4.3 至 2.4.5 版本暴露了未认证的 AI 扫描器调试端点，这些端点会泄露管理员用户名、API 密钥前缀、扫描标识符、目标域名以及账户元数据。未经身份验证的攻击者可以枚举面板管理员及近期的扫描器活动，从而对多租户部署环境进行资产梳理，并为后续的后续攻击提供支持。
Possible ATT&CK Techniques 3 AI
T1114.001 · Local Email Collection T1589.003 · Employee Names T1006 · Direct Volume Access
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-87820
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner
Source: CVE Program / CVE List V5
Vulnerability Description
CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity to inventory multi-tenant installations and facilitate follow-on attacks.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| usmannasir | cyberpanel | 2.4.3 ~ 2.4.6 | - |
|
II. Public POCs for CVE-2026-87820
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-87820
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-87820 (1)
Vendor Advisories for CVE-2026-87820 (2)
IV. Related Vulnerabilities
Same product: cyberpanel
-
CVE-2026-67613
CyberPanel < 3.0.0 Path Traversal File Read via cloudAPI Rea -
CVE-2026-67614
CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypa -
CVE-2026-71966
CyberPanel 2.4.3 Authenticated Command Injection via starRem -
CVE-2026-71965
CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature -
CVE-2026-71964
CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Up
Same vendor: usmannasir
-
CVE-2026-67613
CyberPanel < 3.0.0 Path Traversal File Read via cloudAPI Rea -
CVE-2026-67614
CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypa -
CVE-2026-71966
CyberPanel 2.4.3 Authenticated Command Injection via starRem -
CVE-2026-71965
CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature -
CVE-2026-71964
CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Up
Same weakness: CWE-200
-
CVE-2026-87810
Siyuan before v3.8.2 Information Disclosure via fullTextSear -
CVE-2026-87032
Tanium addressed an information disclosure vulnerability in -
CVE-2026-87035
Tanium addressed an information disclosure vulnerability in -
CVE-2026-87593
Chrome 153.0.8010.36前编辑功能信息泄露 -
CVE-2026-87437
Chrome 153.0.8010.36 Frames 信息泄露
V. Comments for CVE-2026-87820
No comments yet