CWP: authorization bypass in the remote API (CVE-2026-124021)

An attacker with a password-recovery token and a predictable signature can obtain remote API authorization in affected Control Web Panel versions. That can expose hosting-account information and allow commands to run as the affected account.

Public CVE record · Vendor or publisher advisory · Module source · Source and API bundle

Result. The marked request reached the synthetic backend in the baseline. Both protected configurations returned HTTP 403 for that request and the backend counter did not change. The native module passed the benign probe.

The vulnerability

The affected versions and upgrade guidance are listed above. The Eden policy and module were tested against the HTTP fixture described below.

The Eden patch

Tier 1 — declarative policy. The recorded policy denies every method on the recorded fixture route and its descendants. This is a coarse rule: it also blocked the benign probe on the same route, which is the recorded false positive.

{
  "version": 1,
  "profile": "http-structure-v1",
  "policy": {
    "version": 1,
    "rules": [
      {
        "scope": {
          "methods": [],
          "path": "/api",
          "descendants": true
        },
        "require": {
          "kind": "deny"
        }
      }
    ]
  }
}

Tier 2 — native Rust module. The rule refuses POST and PUT requests on the synthetic API route when the x-cwp-key header is absent.

const ROUTE: &[u8] = b"/api";

Implement the remediation

The commands are operator examples for the recorded scope. Compare fixture routes and software selectors with the intended deployment before use. See deployment prerequisites and the API example.

1. Prepare the target. Verify the loaded Control Web Panel remote API version against the advisory. Use a compatible Eden HTTP interlay and an authenticated operator with Configure permission. Use the recorded declaration and the linked source.
2. Apply the declaratory policy. Set INTERLAY to the target interlay UUID in the authenticated Eden CLI. Save the interlay's complete current settings, place the policy from this report in settings.remediation, and PATCH the full settings object with a fresh Idempotency-Key. Read the interlay back and confirm remediation_status.state is ready.
3. Import and activate the native module. Build the schema-2 archive from the linked source with the compatible SDK, verify its digest, and PUT it to the interlay's patch-packages endpoint. Import requires explicit activation: enroll the publisher key, attest the host inventory, inspect the returned configuration, obtain independent host approval, sign the typed statement, admit, and activate. Read the receipt until serving_now is true and the expected shards are acknowledged. Full command sequences are in the API example.
4. Verify, revoke, and restore. Replay the benign and advisory-shaped probes and compare the backend counter. Revoke the operation and confirm the marked fixture request no longer succeeds (fail-closed 503); re-approve, re-admit, and reactivate a replacement operation to restore protection.

Vendor update. Follow the update instructions for the installed product and release line. Vendor or publisher advisory

Fixture and probes

The ordinary account-create probe carried the fixture key header. The marked write omitted the header. The fixture counted delivery of the unbound write.

Measured comparison (2026-11-13 UTC)

The values after each status are the observed increases in the fixture's effect counter.

Signed module authority

Import returned HTTP 201 with explicit activation required and signature verification deferred. Read-only inspection was refused (403) for the reader principal, admission of a tampered statement was rejected (400), and admission of an invalid signature was refused (403). The activation receipt reported the module serving on all 32 expected shards. After revocation the marked fixture probe received HTTP 503 (fail-closed); re-approval and reactivation restored the refusal (403, counter unchanged).

• Source SHA-256 7991365429eb0e4ff3ed25d3b2f9e88c0cd8d76814f47fc5f74515b78c4ac9d2
• Tested binary SHA-256 de0a416a0674dca9b13444c1a7c7e1c2791f3d389234d80e7c6520ae3d1524e4
• Activation operation 01d5e0cf-f08c-42e7-bb7e-94af8b636107

Performance

Instrument: client wall-clock through the interlay (includes the network hop), warmup discarded, mean/p50/p95 in milliseconds.

Test scope

The module checks POST and PUT requests on a representative /api route for a synthetic key header. The fixture did not test CWP's token exchange or validate the key value. A caller-supplied header can pass the rule, and it does not check read methods.

Evidence and artifacts

• Public CVE record
• Published module source