Brief Summary: CVE-2026-32993 — Unauthenticated HTTP Header Injection in cPanel & WHM via nova_error Endpoint

Introduction

An unauthenticated endpoint in cPanel & WHM's web server daemon accepted attacker-controlled input and reflected it directly into HTTP response headers. That allows HTTP response splitting, cache poisoning, and cross-site scripting. Given that cPanel powers hosting infrastructure for millions of websites worldwide, the blast radius of this flaw extends well beyond a single server.

CVE-2026-32993 carries a CVSS score of 8.3 and was disclosed alongside patches on May 13, 2026. The vulnerability sits in the /unprotected/nova_error endpoint of the cpsrvd service, where the status query parameter is not sufficiently sanitized before it goes into the HTTP response. The endpoint requires no authentication, so any remote attacker can reach it trivially.

Technical Information

Root Cause

The vulnerability is classified under CWE-93 (Improper Neutralization of CRLF Sequences in HTTP Headers). The /unprotected/nova_error endpoint in the cpsrvd web server daemon accepts a status query parameter and reflects its value into the HTTP response headers. The bug itself is simple. The application does not validate or strip carriage return (\r, 0x0D) and line feed (\n, 0x0A) characters from the parameter value before adding it to the response.

Because the endpoint lives under the /unprotected/ path, it requires no authentication whatsoever. Any remote client can craft a request to this endpoint and supply a malicious status value.

Attack Flow

Exploitation follows the well-documented pattern of HTTP response splitting:

1. Reconnaissance: The attacker identifies the /unprotected/nova_error endpoint on a target cPanel server. This endpoint is publicly accessible and requires no credentials.

2. Crafting the payload: The attacker constructs a URL where the status query parameter contains CRLF sequences (%0d%0a) followed by attacker-controlled HTTP headers. The injected content could be a Set-Cookie header, a Location header for redirection, or even a complete second HTTP response body.

3. Injecting the response: When the cpsrvd daemon processes the request, it includes the unsanitized status value in the response headers. The CRLF characters terminate the current header line, and the HTTP client (or any intermediary proxy/cache) reads everything after them as additional headers or a new response body.

4. Downstream exploitation: Depending on the attacker's goal, the injected content enables several attack scenarios:

   • Cache poisoning: If a caching proxy sits in front of the cPanel server, the attacker can poison the cache with a malicious response that is then served to other users.
   • Cross-site scripting: By injecting a response body containing JavaScript, the attacker can execute scripts in the victim's browser session with the cPanel domain.
   • Cross-user defacement: The attacker can replace the visible page content for other users who receive the poisoned cached response.
   • Page hijacking: The attacker can redirect users to attacker-controlled domains through injected Location headers.

The lack of authentication is what lifts this from a moderate concern to a high-severity issue. There is no credential barrier and no session requirement, and the advisory mentions no rate limiting that would slow exploitation.

Broader Context

This vulnerability was disclosed on the same day that cPanel released patches for a total of five CVEs, some of them rated high severity. Attackers are also actively going after cPanel. A separate critical authentication bypass, CVE-2026-41940, is being exploited in the wild as a zero day, and public proof-of-concept code is available. CVE-2026-32993 itself has no known exploitation at this time, but the active targeting of cPanel infrastructure makes it a patching priority.

Patch Information

cPanel published a security update on May 13, 2026, that fixes CVE-2026-32993 by correcting the improper sanitization in the cpsrvd web server daemon. The fix adds input validation and sanitization that strips or rejects carriage return and line feed characters (and other header injection sequences) before the status value is reflected into the HTTP response headers.

cPanel & WHM is closed-source software, so no public code diff or commit is available. The vendor advisory confirms that the fix has been backported to all three currently supported release branches:

cPanel issued three separate branch-level builds, which tells us it treated this as a critical fix worth cherry-picking into every supported release tier. That choice reflects the severity of the unauthenticated attack surface.

To apply the patch, administrators should force an update on each affected server by running:

/scripts/upcp --force

Administrators can then confirm the installed version with:

/usr/local/cpanel/cpanel -V

The output should show a version number at or above the thresholds in the table. Servers configured for automatic updates on the RELEASE, CURRENT, or EDGE tiers will receive this fix without manual intervention. Administrators on the STABLE or LTS tiers (or with updates paused) should verify that they are running a patched build. The cPanel changelogs at docs.cpanel.net/changelogs/ list build-level details for each branch.

Affected Systems and Versions

CVE-2026-32993 affects the following products and version ranges:

• cPanel & WHM v132 branch: All versions prior to 11.132.0.32
• cPanel & WHM v134 branch: All versions prior to 11.134.0.26
• cPanel & WHM v136 branch: All versions prior to 11.136.0.10
• WP Squared: All versions prior to 11.136.1.12

The vulnerable component is the cpsrvd web server daemon, specifically the /unprotected/nova_error endpoint. Any server running an affected version with the cpsrvd service exposed to the network is vulnerable. The endpoint requires no authentication, so network access is the only prerequisite for exploitation.

Vendor Security History

cPanel has had an unusual number of security issues recently. Alongside CVE-2026-32993, cPanel released patches for a total of five CVEs on May 13, 2026, with the most serious rated high. More significantly, a separate critical authentication bypass in cPanel & WHM, CVE-2026-41940, is being actively exploited in the wild as a zero day, and proof-of-concept code is publicly available. Several concurrent vulnerabilities, at least one of them under active exploitation, indicate sustained attacker interest in the cPanel platform. That is a reason to keep every cPanel deployment at current patch levels.

References

• NVD: CVE-2026-32993
• cPanel Security Advisory: CVE-2026-32993 — cPanel & WHM / WP2 Security Update, May 13, 2026
• cPanel Changelogs
• OWASP: HTTP Response Splitting
• InMotion Hosting: cPanel Security Patch Coming May 13, 2026
• BleepingComputer: cPanel, WHM Emergency Update Fixes Critical Auth Bypass Bug
• BleepingComputer: Critical cPanel and WHM Bug Exploited as a Zero Day, PoC Now Available
• TechCrunch: Hackers Are Actively Exploiting a Bug in cPanel, Used by Millions of Websites
• Reddit r/cpanel: New Vulnerabilities Discussion