{"id":"CVE-2026-105475","kind":"vulnerability","aliases":["CVE-2026-105475"],"related":[],"title":"cPanel & WHM: anyone with no account can read any mail account's calendar and contacts","description":"Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.","summary":"cPanel says a flaw in cPanel & WHM v124 and later lets an attacker with no account and no credentials read the calendar entries and contacts of any mail account on the server. NVD attributes it to improper neutralization of a NUL byte. The vendor page does not describe the request path and does not say whether it is exploited.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"cPanel & WHM","fixed":["134.0.67","136.0.51","138.0.19"],"affected":">= 124, < 134.0.67 (134 track); < 136.0.51 (136 track); < 138.0.19 (138 track)","ecosystem":"vendor"}],"ecosystems":[],"tags":["calendar","cpanel","hosting","infrastructure","mail-server","whm"],"not_affected_if":["managed-hosting-already-updated","patched-build"],"how_to_check":"Run /usr/local/cpanel/cpanel -V. You are exposed if the version is v124 or later and below the patched build for your track: 134.0.67, 136.0.51 or 138.0.19.","fix":"Update cPanel & WHM to 134.0.67, 136.0.51 or 138.0.19 (or later), depending on your release track. Run /scripts/upcp.","status":"open","published_at":"2026-11-02T21:17:22+00:00","first_seen_at":"2026-11-02T21:35:40+00:00","triaged_at":"2026-11-02T21:37:05+00:00","updated_at":"2026-11-02T21:38:28+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-02T21:37:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"cPanel: NUL byte handling lets remote attackers read any mail account's calendar and contacts","impact":"medium","summary":"cPanel fails to neutralize NUL bytes in input, which lets a remote attacker read calendar and contact data belonging to any mail account on the server. The sources give a CVSS score of 8.7 and do not describe the exact request path or a fixed version.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["cpanel","hosting","mail-server"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attackers read calendar and contact data of any mail account","analyst_note":"Find the cPanel advisory for CVE-2026-105475 to confirm affected and fixed versions, and whether authentication is required.","how_to_check":"- Check the installed cPanel version on the server (`/usr/local/cpanel/cpanel -V`) against the vendor's advisory, which the sources do not list\n- unknown for the affected version ranges","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Hosting servers running cPanel with mail services enabled are likely exposed, since the flaw concerns mail account calendar and contact data. The sources do not state which cPanel versions or mail configurations are affected, so the exact scope is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00067,"input_tokens":4066,"output_tokens":527,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the cPanel advisory for CVE-2026-105475 to confirm affected and fixed versions, and whether authentication is required.","search":"'-105475':18A,21A '-2026':17A,20A 'account':6A,11A,47B,60B,106C 'allow':99C 'anyon':3A 'attack':44B,101C 'attribut':65B 'byte':73B,96C 'calendar':13A,24B,53B,108C 'contact':15A,56B,110C 'cpanel':1A,22A,25B,32B,37B,98C 'credenti':50B 'cve':16A,19A 'data':111C 'describ':79B 'entri':54B 'exploit':90B 'flaw':35B 'host':26B 'improp':68B,91C 'infrastructur':27B 'later':41B 'let':42B 'mail':10A,29B,59B,105C 'mail-serv':28B 'neutral':69B,92C 'nul':72B,95C 'nvd':64B 'page':76B 'path':82B 'read':8A,51B,103C 'remot':100C 'request':81B 'say':33B,86B 'server':30B,63B 'v124':39B 'vendor':75B 'whether':87B 'whm':2A,23A,31B,38B","nicknames":[],"mitigations":[],"who_affected":"Servers running cPanel & WHM v124 or later that host mail accounts are exposed, and no login is needed to exploit it. VPS and dedicated server owners must update themselves. Shared-hosting customers depend on their provider updating. Servers on a patched build can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-02T21:38:28Z","by":"analyst","doc":"https://support.cpanel.net/hc/en-us/articles/44356591132439-Security-CVE-2026-105475-Unauthenticated-Access-to-Calendar-and-Contact-Data-in-cPanel-WHM-October-26-2026","run_id":1433},"products":{"at":"2026-11-02T21:38:28Z","by":"analyst","doc":"https://support.cpanel.net/hc/en-us/articles/44356591132439-Security-CVE-2026-105475-Unauthenticated-Access-to-Calendar-and-Contact-Data-in-cPanel-WHM-October-26-2026","run_id":1433},"how_to_check":{"at":"2026-11-02T21:38:28Z","by":"analyst","doc":"https://support.cpanel.net/hc/en-us/articles/44356591132439-Security-CVE-2026-105475-Unauthenticated-Access-to-Calendar-and-Contact-Data-in-cPanel-WHM-October-26-2026","run_id":1433},"who_affected":{"at":"2026-11-02T21:38:28Z","by":"analyst","doc":"https://support.cpanel.net/hc/en-us/articles/44356591132439-Security-CVE-2026-105475-Unauthenticated-Access-to-Calendar-and-Contact-Data-in-cPanel-WHM-October-26-2026","run_id":1433}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cpanelwhm","whm"],"ptokens":["cpanel","whm"],"labels":["calendar","cpanel","high","hosting","infrastructure","mailserver","whm"],"first_public_at":"2026-11-02T21:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105475","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105475","severity":null,"published_at":"2026-11-02T21:17:22+00:00","modified_at":"2026-11-02T21:17:22+00:00","first_seen_at":"2026-11-02T21:35:40+00:00","fetched_at":"2026-11-02T21:35:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105475:1433","url":null,"severity":null,"published_at":"2026-11-02T21:38:28+00:00","modified_at":"2026-11-02T21:38:28+00:00","first_seen_at":"2026-11-02T21:38:28+00:00","fetched_at":"2026-11-02T21:38:28+00:00","note":"Read cPanel's own advisory (Oct 26, 2026): unauthenticated, v124+, patched 134.0.67/136.0.51/138.0.19. Vendor does not mention NUL byte (that is NVD's wording) or exploitation; exploited left false/unknown. No mitigations or PoC found; no social search done."}],"documents":[{"id":54005,"url":"https://support.cpanel.net/hc/en-us/articles/44356591132439-Security-CVE-2026-105475-Unauthenticated-Access-to-Calendar-and-Contact-Data-in-cPanel-WHM-October-26-2026","title":"cPanel: Security CVE-2026-105475 Unauthenticated Access to Calendar and Contact Data (Oct 26, 2026)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}