Executive brief
A vulnerability in cPanel & WHM allows unauthenticated attackers to manipulate web responses by injecting malicious headers. This type of flaw can be used to perform web cache poisoning or redirect users to fraudulent websites, potentially compromising user credentials or spreading malware. The issue affects the error handling component of the hosting management platform.
Technical details
The vulnerability is a CRLF injection (CWE-93) located in the '/unprotected/nova_error' endpoint of cPanel & WHM. It stems from improper neutralization of the 'status' query parameter before it is included in the HTTP response headers. An unauthenticated remote attacker can exploit this by sending a specially crafted request containing carriage return and line feed characters. This allows the attacker to inject arbitrary headers or even a second response body (HTTP Response Splitting), which can lead to cross-site scripting (XSS), cache poisoning, or session hijacking. A security update was released by cPanel on May 13, 2026.
Affected products
- cPanel cPanel & WHM
Timeline
- 2026-05-13: disclosed
- 2026-05-13: advisory
- 2026-05-13: patched