Unauthenticated Server-Side Request Forgery in OpenPanel by OpenPanel Dev
CVE-2026-85614

9.2CRITICAL

Key Information:

Vendor

Openpanel-dev

Status
Openpanel
Vendor
CVE Published:
4 September 2026

What is CVE-2026-85614?

OpenPanel before version 2.3.0 is vulnerable to an unauthenticated server-side request forgery (SSRF) through the GET /tools/site-checker endpoint. This vulnerability allows attackers to send requests with a fully client-controlled URL parameter, bypassing private IP filtering and DNS-rebinding protections. Consequently, this can lead to unauthorized access to internal services, local host systems, and cloud metadata endpoints, enabling attackers to extract sensitive information such as internal HTTP response titles, headers, status codes, and SSL certificate details.

Affected Version(s)

openpanel 0 < 2.3.0

openpanel 2.3.0

References

https://github.com/Openpanel-dev/openpanel/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/openpanel-api-before...
third-party-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

CyberKareem
.