CVE-2026-41315 affects mdserver-web, a Linux panel, in versions 0.18.0 to 0.18.4. The vulnerability arises from missing authentication on two HTTP interfaces: /modify_crond and /start_task. Attackers can remotely modify default scheduled tasks and trigger their execution, resulting in remote code execution via OS command injection. The CVSS 4.0 score is 9.3, reflecting network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability combines CWE-78 (improper neutralization of special elements in OS commands) and CWE-862 (missing authentication). No patch or official fix has been documented yet.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands on the affected system, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the system. Given the lack of authentication on critical interfaces, the attack surface is broad. No known active exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected interfaces (/modify_crond and /start_task) to trusted users only. Implement external access controls such as firewall rules or VPN to limit exposure. Monitor for unusual activity related to scheduled tasks. Avoid exposing mdserver-web to untrusted networks.