WebPros cPanel &WHM和WP2身份验证绕过漏洞(CVE-2026-41940)

详细信息

漏洞类型

访问控制错误

漏洞描述

WebPros的cPanel & WHM（WebHost Manager）以及WP2（WordPress Squared） 11.40之后的所有版本存在登录流程中CRLF注入导致的认证绕过漏洞，漏洞源于cpsrvd守护进程在处理会话文件时，未对HTTP Basic认证头中的密码字段进行CRLF（回车换行）字符过滤，导致攻击者可以通过注入CRLF字符向服务器端会话文件写入任意键值对，从而伪造管理员会话，允许未认证的远程攻击者未经授权访问控制面板。

修复建议

请升级cPanel & WHM到11.110.0.97、11.118.0.63、11.126.0.54、11.132.0.29、11.134.0.20、11.136.0.5或更高版本，升级WP Squared到136.1.8或更高版本，参考链接： https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026 https://docs.cpanel.net/release-notes/release-notes/ https://docs.wpsquared.com/changelogs/versions/changelog/#13617

参考链接

• https://docs.cpanel.net/release-notes/release-notes

  CVE · release-notes

• https://docs.wpsquared.com/changelogs/versions/changelog/#13617

  CVE · release-notes

• https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py

  NVD · Exploit · Third Party Advisory

• https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/

  NVD · Exploit · Third Party Advisory

• https://nvd.nist.gov/vuln/detail/CVE-2026-41940

  CNNVD

• https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026

  CVE · patch · vendor-advisory

• https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/

  NVD · Press/Media Coverage

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940

  NVD · US Government Resource

• https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026

  CVE · third-party-advisory

• https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow

  CVE · third-party-advisory