CVE-2026-85614

OpenPanel versions before 2.3.0 contain an unauthenticated server-side request forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint, tracked as CVE-2026-85614 and rated critical (CVSS 4.0: 9.2). The endpoint's URL parameter is fully client-controlled, and the server performs no private-IP filtering and has no DNS-rebinding protection, so any remote attacker with network access to the panel can force the OpenPanel server to issue requests to localhost, internal network services, and cloud metadata endpoints. The attacker can read back limited response metadata — internal HTTP response titles, headers, status codes, and SSL certificate information — enabling internal network reconnaissance and disclosure of sensitive details, with high confidentiality impact but no direct integrity or availability impact. Any deployment running OpenPanel prior to 2.3.0 that exposes the site-checker tool over the network is affected. There is currently no public proof-of-concept and no known in-the-wild exploitation; EPSS is 0.2% (6th percentile) and the issue is not in CISA KEV.

What to do: Upgrade to OpenPanel 2.3.0 or later, which resolves this flaw. As interim mitigations, restrict or disable unauthenticated access to /tools/site-checker, limit the panel's network exposure, and consider host-level egress filtering or enforcing cloud metadata hardening (e.g., IMDSv2 on AWS) to reduce SSRF reach into internal services. Review panel and web server access logs for unauthenticated requests to /tools/site-checker to check for probing.