---
id: "CVE-2026-77881"
kind: "vulnerability"
aliases: ["CVE-2026-77881"]
title: "Control Web Panel: blind SQL injection in unauthenticated loopback route"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["control-web-panel", "linux-hosting", "mysql", "runtime", "self-hosted"]
not_affected_if: ["cwp-1.30-or-later"]
published_at: "2026-11-02T16:17:44+00:00"
first_seen_at: "2026-11-02T16:24:05+00:00"
updated_at: "2026-11-02T16:26:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77881", "first_seen_at": "2026-11-02T16:24:05+00:00"}]
---

# Control Web Panel: blind SQL injection in unauthenticated loopback route

Control Web Panel (CWP) before 1.30 has an unauthenticated loopback API route that puts the 'user' parameter straight into a MySQL query. An attacker who can reach the route can use time-based blind SQL injection to read arbitrary database contents, which the route runs as MySQL root.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed CWP version (webpanel_version) and see whether it is below `1.30`.
- Confirm whether the `/user_panel_dashboard/` or `/valid_token/` routes respond on the panel.

## Fix

- Move Control Web Panel to `1.30` or later (webpanel_version).

## Timeline

- 2026-11-02T16:24:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77881

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/control-web-panel-cwp-blind-sql-injection-via-user-parameter

## From the sources

Control Web Panel (CWP) before webpanel_version 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauth_clients table. Attackers can send crafted requests to the unauthenticated route (originally /user_panel_dashboard/, later /valid_token/) to perform time-based blind SQL injection and extract arbitrary database contents.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_