CVE-2026-29811

Received Received - Intake

CyberPanel Domain Alias Misconfiguration Vulnerability

Publication date: 2026-09-13

Last updated on: 2026-09-14

Assigner: MITRE

Description

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a Python "if" statement.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-13

Last Modified

2026-09-14

Generated

2026-10-04

AI Q&A

2026-09-13

EPSS Evaluated

2026-10-02

NVD

CVE-2026-29811

EUVD

EUVD-2026-77075

Affected Vendors & Products

Vendor	Product	Version / Range
cyberpanel	cyberpanel	to 2.4.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1025	The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.

Attack-Flow Graph

Executive Summary

CyberPanel before version 2.4.4 has a flaw where it tries to identify alias domains (domains serving identical content to a primary domain) using an ORM query filter instead of a Python conditional statement. This approach may lead to incorrect detection or bypass of alias domains.

Detection Guidance

This vulnerability is specific to CyberPanel versions before 2.4.4 and involves improper detection of alias domains. To detect it, check your CyberPanel version using the command 'cyberpanel version' or 'cat /usr/local/CyberPanel/VERSION'. If the version is below 2.4.4, the system is vulnerable. Additionally, inspect the code for improper alias domain detection logic in CyberPanel's configuration files or database queries.

Impact Analysis

This vulnerability could allow attackers to bypass security measures by exploiting misconfigured alias domains. It may lead to unauthorized access, content duplication, or other malicious activities depending on the system configuration.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other common standards and regulations. The issue involves improper detection of alias domains in CyberPanel versions before 2.4.4, which could lead to unauthorized domain configurations but does not inherently violate data protection or privacy requirements.

Mitigation Strategies

Update CyberPanel to version 2.4.4 or later to address the vulnerability in domain alias detection.

Hi! I’m here to help you understand CVE-2026-29811. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70