CVE-2026-85612

OpenPanel versions before 2.3.0 contain an unauthenticated server-side request forgery (CWE-918) in the /misc/favicon and /misc/og API endpoints. Both endpoints accept an attacker-supplied url parameter with insufficient validation, so any unauthenticated client can direct the server to fetch an arbitrary URL. An attacker can abuse this to make the server request internal hosts and cloud metadata endpoints, and because small responses are returned verbatim, they can steal cloud credentials and enumerate internal services. Any OpenPanel deployment running a version earlier than 2.3.0 is affected, with the greatest risk on panels reachable from the internet. No exploitation is currently known: there is no public proof of concept, it is not in CISA KEV, and EPSS estimates a 0.2% probability of exploitation in the next 30 days.

What to do: Upgrade OpenPanel to version 2.3.0 or later, which fixes the flaw. As interim mitigation, restrict unauthenticated access to /misc/favicon and /misc/og at a reverse proxy or firewall and limit the panel server's outbound access to cloud metadata services (e.g., 169.254.169.254) and internal network ranges. Review access logs for requests to these endpoints containing internal or metadata URLs, which would indicate SSRF probing.