CWP: host header injection poisons password-reset links (CVE-2026-124020)

An unauthenticated attacker can manipulate a Control Web Panel password-reset link by supplying a Host header. If the recovery token is exposed, the attacker can reset the user's password and gain control of the hosting account.

Public CVE record · Vendor or publisher advisory · Module source · Source and API bundle

Result. The marked request reached the synthetic backend in the baseline. Both protected configurations returned HTTP 403 for that request and the backend counter did not change. The native module passed the benign probe.

The vulnerability

The affected versions and upgrade guidance are listed above. The Eden policy and module were tested against the HTTP fixture described below.

The Eden patch

Tier 1 — declarative policy. The recorded policy denies every method on the recorded fixture route and its descendants. This is a coarse rule: it also blocked the benign probe on the same route, which is the recorded false positive.

{
  "version": 1,
  "profile": "http-structure-v1",
  "policy": {
    "version": 1,
    "rules": [
      {
        "scope": {
          "methods": [],
          "path": "/index.php",
          "descendants": true
        },
        "require": {
          "kind": "deny"
        }
      }
    ]
  }
}

Tier 2 — native Rust module. The module checks the start of the Host value for the fixture's configured prefix on /index.php requests containing the resetpwd marker.

static PINNED: &[u8] = b"panel.corp.example";

Implement the remediation

The commands are operator examples for the recorded scope. Compare fixture routes and software selectors with the intended deployment before use. See deployment prerequisites and the API example.

1. Prepare the target. Verify the loaded Control Web Panel version against the advisory. Use a compatible Eden HTTP interlay and an authenticated operator with Configure permission. Use the recorded declaration and the linked source.
2. Apply the declaratory policy. Set INTERLAY to the target interlay UUID in the authenticated Eden CLI. Save the interlay's complete current settings, place the policy from this report in settings.remediation, and PATCH the full settings object with a fresh Idempotency-Key. Read the interlay back and confirm remediation_status.state is ready.
3. Import and activate the native module. Build the schema-2 archive from the linked source with the compatible SDK, verify its digest, and PUT it to the interlay's patch-packages endpoint. Import requires explicit activation: enroll the publisher key, attest the host inventory, inspect the returned configuration, obtain independent host approval, sign the typed statement, admit, and activate. Read the receipt until serving_now is true and the expected shards are acknowledged. Full command sequences are in the API example.
4. Verify, revoke, and restore. Replay the benign and advisory-shaped probes and compare the backend counter. Revoke the operation and confirm the marked fixture request no longer succeeds (fail-closed 503); re-approve, re-admit, and reactivate a replacement operation to restore protection.

Vendor update. Follow the update instructions for the installed product and release line. Vendor or publisher advisory

Fixture and probes

The ordinary probe used the fixture Host value. The marked probe supplied a different Host on the same synthetic reset route. The fixture recorded the foreign host reaching its reset handler.

Measured comparison (2026-11-13 UTC)

The values after each status are the observed increases in the fixture's effect counter.

Signed module authority

Import returned HTTP 201 with explicit activation required and signature verification deferred. Read-only inspection was refused (403) for the reader principal, admission of a tampered statement was rejected (400), and admission of an invalid signature was refused (403). The activation receipt reported the module serving on all 32 expected shards. After revocation the marked fixture probe received HTTP 503 (fail-closed); re-approval and reactivation restored the refusal (403, counter unchanged).

• Source SHA-256 899e054174a6f52bcc7dd04b9f28537046f55104398a37da1cb0c0ab672418ca
• Tested binary SHA-256 b87e6bc6e3ccb00008f59df2e2acdacc1d2f4328dc77c50096c72b5a433a1d67
• Activation operation 6ee76e1c-aff1-43b3-a36d-afb531502c56

Performance

Instrument: client wall-clock through the interlay (includes the network hop), warmup discarded, mean/p50/p95 in milliseconds.

Test scope

The module checks a synthetic /index.php resetpwd request. The advisory identifies /v1/lostpass/ as the affected route. The source checks a prefix of the Host value, so extra characters after the configured prefix can pass. The fixture did not exercise email delivery or token replay. This rule does not establish exact host validation.

Evidence and artifacts

• Public CVE record
• Published module source