CVE-2026-101011: BaoTa aaPanel: SQL injection in domain status handler

MEDIUMPoC AVAILABLECISA: TRACK*

Published September 28, 2026

CISO Take

CVE-2026-101011 is a SQL injection in the get_domain_status function of aaPanel BaoTa up to 11.8.0, a general-purpose server control panel. It is not an AI/ML product, so it only matters if your AI hosts (model servers, notebooks, ML web UIs) are managed through this panel. The CVSS score is a moderate 4.7 because exploitation requires high privileges (PR:H). The EPSS score is 0.002, but that sits in the 91st percentile. The CVE is not in CISA KEV and CISA SSVC says TRACK*. A public proof-of-concept is linked in the references (a GitHub gist), even though our exploit flag reads No, and the vendor has not responded to disclosure. If you run BaoTa on infrastructure hosting AI workloads, restrict panel access to trusted networks or a VPN, check for a vendor patch, and review panel and database logs for anomalous domain-status requests.

Sources:NVDEPSSVulDB

What is the risk?

Medium overall. The attack is network-reachable and low complexity, but it needs an authenticated high-privilege account, which limits the pool of attackers. Impact is limited to low confidentiality, integrity and availability (C:L/I:L/A:L). Exploit code appears to be public, the vendor has been silent, and no patched version is known, so exposure persists until mitigated. Our data conflicts on exploit availability (the exploit flag says No, yet a gist is referenced as an exploit), so assume a working PoC exists. Risk to AI/ML systems is indirect and depends on whether the panel manages hosts running AI workloads.

How does the attack unfold?

Initial Access

Attacker uses valid or stolen high-privilege credentials to reach the exposed BaoTa panel over the network.

AML.T0049

Exploitation

Attacker injects SQL through the get parameter of get_domain_status in the Domain Handler component.

Collection

Attacker reads or modifies panel database records such as domain, site and credential metadata.

Impact

Exposed metadata or altered configuration enables pivoting to or disruption of co-hosted AI/ML services.

Initial Access

Attacker uses valid or stolen high-privilege credentials to reach the exposed BaoTa panel over the network.

AML.T0049

Exploitation

Attacker injects SQL through the get parameter of get_domain_status in the Domain Handler component.

Collection

Attacker reads or modifies panel database records such as domain, site and credential metadata.

Impact

Exposed metadata or altered configuration enables pivoting to or disruption of co-hosted AI/ML services.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
BaoTa	—	—	No patch

Do you use BaoTa? You're affected.

How severe is it?

CVSS 3.1

4.7 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 10% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRHigh

UINone

SUnchanged

CLow

ILow

ALow

What should I do?

1 step

1) Inventory servers running aaPanel/BaoTa 11.8.0 or earlier, especially those hosting AI/ML services. 2) Check the vendor channel for a fixed release; none is currently documented, so apply compensating controls. 3) Restrict panel access to an admin VPN or IP allowlist and never expose the panel port to the internet. 4) Enforce strong unique credentials and MFA or access controls for panel administrators, and review the admin account list. 5) Add WAF or reverse-proxy rules to block SQL metacharacters in requests to the domain module endpoints. 6) Monitor panel and database logs for unusual requests to get_domain_status and for SQL errors. 7) Rotate secrets stored on or managed through the panel if compromise is suspected.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassFrameworkAPIAML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

GOVERN 6.1-Policies and procedures address AI risks arising from third-party software and data

Frequently Asked Questions

What is CVE-2026-101011?

Is CVE-2026-101011 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-101011, increasing the risk of exploitation.

How to fix CVE-2026-101011?

1) Inventory servers running aaPanel/BaoTa 11.8.0 or earlier, especially those hosting AI/ML services. 2) Check the vendor channel for a fixed release; none is currently documented, so apply compensating controls. 3) Restrict panel access to an admin VPN or IP allowlist and never expose the panel port to the internet. 4) Enforce strong unique credentials and MFA or access controls for panel administrators, and review the admin account list. 5) Add WAF or reverse-proxy rules to block SQL metacharacters in requests to the domain module endpoints. 6) Monitor panel and database logs for unusual requests to get_domain_status and for SQL errors. 7) Rotate secrets stored on or managed through the panel if compromise is suspected.

What systems are affected by CVE-2026-101011?

This vulnerability affects the following AI/ML architecture patterns: Server management panels hosting ML web UIs, Model serving hosts, Self-hosted AI application stacks.

What is the CVSS score for CVE-2026-101011?

CVE-2026-101011 has a CVSS v3.1 base score of 4.7 (MEDIUM). The EPSS exploitation probability is 0.20%.

What is the AI security impact?

Affected AI Architectures

Server management panels hosting ML web UIsModel serving hostsSelf-hosted AI application stacks

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

NIST AI RMF: GOVERN 6.1

What are the technical details?

Original Advisory

A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. This affects the function get_domain_status of the file /www/server/panel/mod/project/domain/domainMod.py of the component Domain Handler. The manipulation of the argument get results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Exploitation Scenario

An attacker obtains or already holds a high-privilege panel account, for example through credential reuse or phishing. They send a crafted request to the Domain Handler endpoint, injecting SQL through the get argument of get_domain_status, following the public PoC. They extract or modify panel database content such as domain, site and credential metadata. They then use that information to pivot to co-hosted AI services like a model-serving API or an ML web UI, or to disrupt them.

Weaknesses (CWE)

CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component CWE-89Improper Neutralization of Special Elements used in an SQL Command

CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

[Requirements] Programming languages and supporting technologies might be chosen which are not subject to these issues.
[Implementation] Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.

Source: MITRE CWE corpus.