Authenticated Remote Code Execution in CyberPanel

CyberPanel version 2.4.3 is vulnerable to an authenticated remote code execution flaw within its remote backup management functionality. The vulnerability arises from an insecure implementation of SSH public key retrieval, where the application fails to validate the source of remote server configurations. An authenticated attacker can supply a malicious remote server address to the backup service, which then retrieves an attacker-controlled public key and writes it directly to the '/root/.ssh/authorized_keys' file. This provides the attacker with persistent root-level SSH access to the underlying host system. This vulnerability was addressed in commit eca0c3c. Defenders should prioritize auditing CyberPanel configurations and ensuring updates to versions beyond 2.4.3 are applied to mitigate the risk of unauthorized persistence.

Attack Chain

1. The attacker authenticates to the CyberPanel management interface using compromised or registered credentials.
2. The attacker navigates to the remote backup configuration settings.
3. The attacker provides a malicious remote server address in the backup target field.
4. The application initiates an SSH connection to the attacker-controlled server to retrieve backup configuration files.
5. The attacker's server delivers a payload containing a public SSH key disguised as part of the backup process.
6. The CyberPanel application process, running with elevated privileges, writes the received public key to the '/root/.ssh/authorized_keys' file.
7. The attacker establishes an SSH session to the host system using the corresponding private key.
8. The attacker obtains full, persistent root access to the server.

Impact

Successful exploitation of this vulnerability grants an attacker full root-level persistence on the CyberPanel host. This facilitates complete system compromise, including the potential for data exfiltration, service disruption, and lateral movement within the hosting infrastructure.

Recommendation

• Update CyberPanel to a version containing the fix for CVE-2026-71965 (commit eca0c3c).
• Monitor file access events for changes to the '/root/.ssh/authorized_keys' file on servers running CyberPanel.
• Restrict administrative access to the CyberPanel interface to trusted IP ranges to prevent unauthorized authentication.
• Implement host-based monitoring to detect unexpected SSH key injections in critical system directories.