Techniques
Sample rules
Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940)
- source: elastic
- technicques:
- T1190
Description
Identifies the network signature of CVE-2026-41940, a pre-auth root-level authentication bypass in cPanel and WebHost Manager (WHM) caused by a CRLF injection in the session writer. The exploit-inherent shape on the wire is a “GET /” request to a cPanel/WHM admin port (typically TCP/2087, 2086, 2083, 2082, 2095, 2096) carrying an “Authorization: Basic” header whose base64-decoded value contains CRLF-injected session fields, which causes cpsrvd to respond with a 3xx redirect whose “Location” header leaks a “/cpsessNNNNNNNNNN” token granting the attacker a privileged session. This is the network-layer equivalent of the cPanel “access_log” artifact identified by Unfold and watchTowr as the first bulletproof detection for this CVE: a “GET /” recorded with “auth_method=b” (HTTP Basic). Legitimate access to “GET /” on a WHM admin port returns 200 with the login screen and never includes HTTP Basic credentials, so this combination is not produced by normal use.
Detection logic
(
(
(data_stream.dataset: network_traffic.http or (event.category: network_traffic and network.protocol: http)) and
http.response.status_code >= 300 and http.response.status_code <= 399 and
http.request.headers.authorization: Basic* and
http.response.headers.location: /cpsess*
)
or
(
data_stream.dataset: zeek.http and
zeek.http.client_header_names: AUTHORIZATION and
zeek.http.server_header_names: LOCATION
)
) and
http.request.method: GET and
url.path: "/" and
destination.port: (2087 or 2086 or 2083 or 2082 or 2095 or 2096)