A pre-auth CRLF injection on the cPanel side, patched on May 13, 2026.
The targeted endpoint is /unprotected/nova_error
The unprotected path is cPanel’s public surface, the part you can touch without logging in.
There’s a bug here: whatever you write into the status parameter, it adds to the response header without sanitizing it.
What we call CRLF is actually two control characters: \r\n
That hidden, invisible separator that splits HTTP header lines from each other.
It looks ordinary, but those two bytes are what carry the whole structure of HTTP.
When you put %0d%0a, its URL-encoded form, into the status parameter and write your own header after it, the server interprets this as “a new header line has arrived”.
If you’re asking how an attacker abuses this, the typical scenarios go like this:
The first is injecting a fake Set-Cookie.
Pinning the victim’s session cookie to a value the attacker chooses and setting up session fixation.
The second is cache poisoning
If there’s a CDN or reverse proxy in between, the poisoned response gets written to the cache and served to the next users.
The third is changing the Content-Type or Location headers so the response body gets redirected to the attacker.
The conceptual payload looks like this:
GET /unprotected/nova_error?status=foo%0d%0aSet-Cookie:%20attacker=1 HTTP/1.1
Host: target-cpanelIn the response coming back from the server, the line Set-Cookie: attacker=1 shows up as a trusted header.
The browser accepts it without question, because the source is the cPanel server itself.
The CVSS score is 8.3 (High)
The impact doesn’t stay on the server; it jumps to the browser and the cache layer.
On the CISA side it’s flagged automatable, meaning it’s a vector perfectly suited to mass scanning + automated exploitation.
Affected versions:
11.132.0.0 through 11.132.0.31
11.134.0.0 through 11.134.0.25
11.136.0.0 through 11.136.0.9On the WP Squared side:
All versions from 11.132.1.0 through 11.136.1.11 includedThe update is done through the classic cPanel flow.
/scripts/upcp --forceThe command updates all cPanel components to the latest version. If automatic updates are turned off, you need to trigger it manually. If you’d rather go through the WHM panel, the Upgrade to Latest Version tab does the same job.
The basic rule for the developer side is this:
Strip the \r and \n characters before putting user-supplied data into an HTTP response header. A whitelist-based approach is always safer than a blacklist. If you’re on the server side, add a WAF rule that blocks the %0d%0a - %0a - \r\n patterns. If you use cPanel, because of the shared hosting structure, a flaw on one server spills over to the others.
Sources
https://nvd.nist.gov/vuln/detail/CVE-2026-32993
https://support.cpanel.net/hc/en-us/articles/40437313190295-Security-CVE-2026-32993-cPanel-WHM-WP2-Security-Update-May-13-2026