CVE-2026-41940

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 11.86.0.41 cPanel versions prior to 11.110.0.97 cPanel versions prior to 11.118.0.63 cPanel versions prior to 11.124.0.35 cPanel versions prior to 11.126.0.54 cPanel versions prior to 11.130.0.19 cPanel versions prior to 11.132.0.29 cPanel versions prior to 11.134.0.20 cPanel versions prior to 11.136.0.5 WHM versions prior to 11.86.0.41 WHM versions prior to 11.110.0.97 WHM versions prior to 11.118.0.63 WHM versions prior to 11.124.0.35 WHM versions prior to 11.126.0.54 WHM versions prior to 11.130.0.19 WHM versions prior to 11.132.0.29 WHM versions prior to 11.134.0.20 WHM versions prior to 11.136.0.5 WP Squared versions prior to 136.1.7

Description An authentication bypass exists in the login flow of the cpsrvd service daemon, affecting cPanel, WHM, and WP Squared. The issue stems from improper sanitization of the Authorization header, allowing a CRLF (Carriage Return Line Feed) injection. By sending a specially crafted Basic Authorization header containing r characters, an unauthenticated remote attacker can inject arbitrary properties, such as user=root, into temporary session files stored on disk. When the service reloads these files, the injected values are treated as valid, granting the attacker full administrative root access without a password.

Approximately 1.5 to 2 million instances are estimated to be exposed worldwide. Real-world exploitation has been observed, including campaigns by the Sorry ransomware group, which uses the flaw to deploy Linux-targeted ransomware, and the threat actor Mr Rot13, who deploys backdoors and exfiltrates credentials via Telegram. Additionally, a supply chain attack was identified where compromised GitHub Actions workflows were used to scan for and exploit this vulnerability across numerous repositories.

Recommendations Update cPanel and WHM to versions 11.86.0.41, 11.110.0.97, 11.118.0.63, 11.124.0.35, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.134.0.20, or 11.136.0.5. Update WP Squared to version 136.1.7 or later. As a temporary mitigation, block inbound traffic on ports 2082, 2083, 2086, 2087, 2095, and 2096, or restrict access to these ports to trusted static IP addresses or VPN ranges. As a temporary workaround, consider stopping the cpsrvd and cpdavd services until patches are applied.