Security advisory · VP-2026-002
Cross-site request protection did not apply in some panel sessions
The panels' protection against cross-site request forgery did not apply in some sessions. In those sessions a web page opened by a panel user could have sent requests to the panel on that user's behalf. Vanta Panel 5.41 applies the protection in every session.
- Severity
- Medium
- Affected
- Vanta Panel versions before 5.41
- Fixed in
- Vanta Panel 5.41
- Component
- vPanel and vWHM sessions
- Published
Who is affected?
vPanel and vWHM users on versions before 5.41 who opened a malicious web page in the same browser.
Affected: Vanta Panel versions before 5.41. Fixed in Vanta Panel 5.41.
What should I do?
Update to Vanta Panel 5.41 or later. Nothing else is needed.
To see which version a server runs, open vWHM: the version is shown under Updates and at the bottom of every page. Updates lists every published advisory that affects that version.
Is the fix installed automatically?
Yes. The fix takes effect as soon as the update is installed.
Credit
Found in Vanta Panel's own security review.
References
Found a security problem in Vanta Panel?
Email security@vantapanel.com privately rather than opening a public issue. How to report a vulnerability.
Questions about VP-2026-002
Something else? Ask support or read the docs.
Which Vanta Panel versions are affected by VP-2026-002?
Vanta Panel versions before 5.41 that have not installed the fix. It is fixed in Vanta Panel 5.41.
What should I do about VP-2026-002?
Update to Vanta Panel 5.41 or later. Nothing else is needed.
Is the fix for VP-2026-002 installed automatically?
Yes. The fix takes effect as soon as the update is installed.
Other advisories
VP-2026-007Criticalfixed in 5.54
Critical PHP vulnerabilities CVE‑2026‑109618 and CVE‑2026‑109619
VP-2026-006Mediumfixed in 5.52
Some removed database hosts and subdomains stayed active
VP-2026-005Highfixed in 5.50
Backup restores and cPanel imports could reach other accounts' data
Keep every server on the latest release.
Automatic updates are on by default: each signed release installs itself within a day, and vWHM warns about any advisory that affects the version you run.
curl -fsSL https://get.vantapanel.com | sudo bash