Control Web Panel Flaws Let Attackers Bypass Login and Run Commands as Root — CVE-2026-104080 Fixed Only in CWP 1.29

Cyber · 2026-11-04 · By H.A

Control Web Panel Flaws Let Attackers Bypass Login and Run Commands as Root — CVE-2026-104080 Fixed Only in CWP 1.29

A batch of newly published Control Web Panel CVEs covers an authentication bypass, path traversal, file write and several command injections, including an unauthenticated root command injection (CVE-2026-104080) fixed only in CWP 1.29, released October 31.

What Happened

On November 2, security researchers published a batch of CVEs for Control Web Panel (CWP), the free Linux hosting control panel formerly called CentOS Web Panel. CWP is widely used on low-cost VPS and dedicated servers running AlmaLinux, Rocky Linux and other Enterprise Linux distributions. The bugs include:

The most serious, CVE-2026-104080, lets an unauthenticated attacker run commands as root through an internal API route. It was only fixed in CWP 1.29, released on October 31, two days before the CVE went public. Many servers will still be on older builds.

Technical Details

According to the CVE records published by the researchers:

Taken together, the flaws follow one pattern: user panel modules and internal API routes pass request data into shell commands and file paths without escaping it. They also assume a login check has stopped execution when it has not. The researchers describe the issue as pre-auth module dispatch, meaning code paths reachable before authentication completes.

Severity scores vary. The researchers' own CVSS 3.1 scores are 7.8 to 8.8. Some third-party trackers list CVE-2026-77876 as 9.8 critical, treating it as fully unauthenticated, while the CNA vector for CVE-2026-73696 assumes low privileges. Read the scores as a range. A chain of an auth bypass plus a root command injection on a hosting panel is a full server takeover.

Exploitation Status

As of November 3, none of these CVEs is in CISA's KEV catalog, and there are no public reports of exploitation in the wild. That may not last. CWP has a history here: CVE-2022-44877, a pre-auth command injection in the CWP login page, was exploited in the wild soon after a public proof of concept appeared, and CISA added it to KEV. Hosting panels are a favourite target because one compromise gives access to every site, mailbox and database on the server.

Who Is Affected

What To Do Now

  1. Update CWP to 1.29 or later and confirm the version in the admin panel. Through the CLI:
sh /scripts/update_cwp

Then confirm the running version on the admin panel dashboard.

  1. Restrict panel ports to trusted IPs with CSF, which CWP ships with:
# /etc/csf/csf.conf: remove 2030,2031,2082,2083 from TCP_IN, then allow your admin IP only
csf -a 203.0.113[.]10 "CWP admin"
csf -r
  1. Check for signs of compromise on servers that were exposed while running old builds:
last -n 50
find /usr/local/cwpsrv /home -name "*.php" -newer /etc/passwd -mtime -14 2>/dev/null | head -50
grep -E "valid_token|newpass|protected_directory|phpini_editor" /usr/local/cwpsrv/logs/access_log* | tail -100
crontab -l; ls -la /etc/cron.d/

Look for unknown cron jobs, new root SSH keys in /root/.ssh/authorized_keys, and PHP files in web roots that you did not deploy.

  1. Rotate credentials (root, panel, database and mail) on any server where you find suspicious activity, and treat it as fully compromised.

Why It Matters

CWP's appeal is that it is free and does almost everything a commercial panel does. The cost is a large, root-privileged PHP codebase that faces the internet on thousands of small hosting servers. This batch is a reminder that the hosting control panel is often the weakest part of a server: it has root, it is reachable from the web, and it is easy to forget to update. If you run CWP, the fix has been available since October 31.

REEF SENTINEL