CVE-2026-41940 Explained: The cPanel & WHM Authentication Bypass That Hit 1.5M Servers

Two reminders from the vendor advisory: servers with auto-update disabled or version pinning will not patch themselves, and you should restart cpsrvd after updating (/scripts/restartsrv_cpsrvd).

The bug, in plain English

The shortest honest description:

The vulnerability isn't a single mistake. It's three weaknesses lined up end-to-end:

A sanitizer that wasn't called on the dangerous code path. cPanel already had a function to strip \r\n=, from session values, but it was the caller's responsibility to invoke it. The Basic-auth handler in cpsrvd didn't.

An encryption step that silently turned itself off. The session writer encrypts the password field using a per-session secret embedded in the session cookie. If that secret is missing, the original code skipped encryption entirely instead of refusing the operation. So an attacker who sends a truncated cookie causes their payload to land on disk in plaintext.

A two-file session model that hides — and then later reveals — the injection. Sessions exist in two places:

• a line-oriented raw file, and
• a JSON cache.

The loader reads the cache first, where injected newlines look like harmless escape sequences inside one big string. A separate code path (the "token denied" handler) re-parses the raw file and rewrites the cache, promoting the injected lines into top-level keys the loader will trust.

Figure 2. cPanel session file vs JSON cache CRLF injection diagram CVE-2026-41940

When you put those three together, an unauthenticated HTTP request can install an admin session for root.

Why each safeguard failed

It's worth dwelling on why a hardened, decade-old codebase shipped this. Each layer failed for a recognizable reason.

Figure 3. CVE-2026-41940 four security layer failures Swiss cheese model

Layer 1 — Input sanitation: "every caller must remember"

Sanitation lived in a helper that callers were expected to invoke before saving a session. Most callers did. One — the Basic-auth path that takes credentials directly off an HTTP header — did not. This is a textbook "defense at the source instead of the sink" failure. As long as sanitation is opt-in, it will eventually be opted out of. The patch fixes this by moving the sanitizer inside the save function.

Layer 2 — Encryption keyed on attacker-controllable data

The per-session encryption key is read from the session cookie. The original code essentially said "if we have a key, encrypt; otherwise, just save." The otherwise branch was reachable by the attacker, because the attacker controls the cookie. Encryption that the input can disable is not encryption. The patched code distinguishes the two cases and never writes a raw password to disk.

Layer 3 — Cache and source-of-truth divergence

Two on-disk representations of the same session existed for performance reasons: a raw text file and a JSON cache. JSON encodes embedded newlines as escape sequences inside a string, while the raw text format treats them as record separators. The same bytes therefore mean two different things depending on which file you parse. An attacker who can write to the raw file and find a code path that re-parses raw → JSON wins, because they can shift their payload from "looks like one big string" to "looks like multiple top-level fields."

Layer 4 — Authentication that can be skipped by setting a flag

The final indignity: the password check in docheckpass_whostmgrd short-circuits to "AUTH OK" if the session contains a successful_internal_auth_with_timestamp value. That field exists for legitimate reasons (single-sign-on flows, internal tooling), but its mere presence — with no cryptographic binding — is treated as proof of prior authentication. Because the attacker can now plant arbitrary fields, they can plant that field. A flag that means "trust me, I already checked" must be cryptographically bound to the thing that actually checked.

Exploit chain at a glance

Without reproducing the full walkthrough or any working PoC payload, the chain has four conceptual steps. Each one is interesting only because the previous one exists.

Figure 4. CVE-2026-41940 cPanel exploit chain four steps to root access

The whole chain is a handful of HTTP requests and zero credentials. From step 4 onward, full WHM API access trivially yields root RCE through any of the legitimate features WHM exposes (custom hooks, package management, PHP-FPM configuration, etc.).

Detection and IOCs

Figure 5. Detection Cheat Sheet for CVE-2026-41940

cPanel published a vendor detection script that performs filesystem-based triage. Defensive teams should also look for:

• Session files under /var/cpanel/sessions/raw/ whose pass= value contains embedded \r or \n bytes, or where pass= is followed on the next line by something that looks like another key=value pair.
• Sessions in which privileged-looking keys (hasroot=1, tfa_verified=1, successful_internal_auth_with_timestamp=*) coexist with origin_as_string=...method=badpass — that combination means the session was minted from a failed login and then "elevated."
• Access-log sequences where a 307 redirect to /cpsessXXXXXXXXXX/ appears without a preceding successful POST /login/.
• Cookies of the form whostmgrsession=:<name> (no ,<32-hex> tail) on requests that carry an Authorization: Basic header — this is the signature of the no-encryption code path being intentionally tickled.

A couple of triage one-liners:

Given confirmed in-the-wild exploitation since late February 2026, any cPanel host that was internet-exposed and unpatched during that window should be treated as suspect, not hypothetical.

Mitigation checklist for CVE-2026-41940 exploitation attacks

1. Patch. Update via /scripts/upcp --force. Confirm with /usr/local/cpanel/cpanel -V. Restart cpsrvd.
2. Manually patch pinned or auto-update-disabled servers. They will not heal themselves.
3. Rotate credentials. Force-reset root and every WHM reseller password. Rotate API tokens. Re-issue SSH keys stored in WHM-managed accounts.
4. Purge sessions in /var/cpanel/sessions/raw/ and /var/cpanel/sessions/cache/.
5. Hunt for persistence. Audit cron entries (system and per-user), ~/.ssh/authorized_keys, custom WHM hooks, and packages installed during the exposure window.
6. If you cannot patch immediately, block inbound TCP/2083, TCP/2087, TCP/2095, TCP/2096 at the perimeter, or stop cpsrvd and cpdavd. This is the same containment several major hosting providers used.

Lessons that generalize

A few takeaways worth carrying into other codebases:

• Sanitize at the sink. "Remember to call X before Y" rules will be forgotten. Put the check inside Y.
• Don't let untrusted input disable security checks. A falsy value should not silently turn off encryption — it should fail closed.
• Two representations of the same data is a vulnerability shape. Raw vs. cache, JSON vs. flat, normalized vs. raw — wherever a parser disagrees with another parser about what a byte sequence means, that disagreement is exploitable.
• "Already authenticated" flags need cryptographic binding. A boolean in a session that says "skip the password check" must be unforgeable, not just present.
• Pre-auth state is attack surface. Anything written to disk on the strength of an unauthenticated request must be assumed attacker-controlled.

How Picus Helps Simulate CVE-2026-41940 Attacks?

We strongly recommend simulating the CVE-2026-41940 cPanel & WHM authentication bypass to validate the effectiveness of your security controls against pre-authentication exploitation attempts. With the Picus Security Validation Platform, you can safely emulate the full CRLF injection and session-promotion attack chain in your environment — and measure exactly how your WAF, EDR, and SIEM rules respond.

You can also test your defenses against other high-impact vulnerability exploitation attacks — including regreSSHion (CVE-2024-6387), Citrix Bleed (CVE-2023-4966), and Follina (CVE-2022-30190) — within minutes using a 14-day free trial of the Picus Platform.

The Picus Threat Library includes the following threats for CVE-2026-41940 exploitation attacks:

Start simulating emerging threats today and get actionable mitigation insights with a  14-day free trial  of the Picus Security Validation Platform.

References

• cPanel Security Advisory: Critical Vulnerability with cPanel & WHM Login Authentication (April 28, 2026).
• watchTowr Labs — original technical analysis and PoC by Sina Kheirkhah (April 29, 2026): labs.watchtowr.com.
• Rapid7 Emerging Threat Report on CVE-2026-41940.
• CISA Known Exploited Vulnerabilities catalog entry.
• BleepingComputer, SecurityWeek, CyberScoop, The Register — coverage of in-the-wild exploitation since Feb 23, 2026.
• KnownHost community advisory confirming pre-disclosure exploitation.

Frequently Asked Questions