CVE-2026-32993: HTTP Header Injection in cPanel

The impact of CVE-2026-32993 is significant due to its unauthenticated nature and the potential for HTTP header injection. An attacker could leverage this vulnerability to redirect users to malicious websites (phishing), inject tracking headers for data exfiltration, or even modify the server's behavior by manipulating response headers. This could lead to credential theft, malware distribution, or defacement of hosted websites. The lack of authentication lowers the barrier to entry, making it accessible to a wider range of attackers. The /unprotected/nova_error endpoint is often overlooked in security assessments, making this a particularly concerning vulnerability.

1. 予約済み2026-03-17
2. 公開日2026-05-13
3. 更新日2026-05-14

The primary mitigation for CVE-2026-32993 is to upgrade cPanel to version 11.136.1.12 or later, which contains the necessary fix. If immediate upgrade is not possible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious characters or patterns in the status query parameter of the /unprotected/novaerror endpoint. Alternatively, restrict access to the /unprotected/novaerror endpoint to trusted networks or IP addresses. Thoroughly review and harden cPanel's configuration, ensuring that all unnecessary features and endpoints are disabled. After upgrading, confirm the fix by attempting to inject a custom HTTP header via the /unprotected/nova_error endpoint; the request should be rejected.