Cross-Site Scripting in oPanel DNS Management

Executive Summary

CVE-2026-50980 is a stored Cross-Site Scripting (XSS) vulnerability in oPanel versions before v1.20.25. It occurs when oPanel queries an attacker-controlled nameserver for DNS records like TXT records and reflects raw responses without proper HTML sanitization. This allows malicious JavaScript to execute in a user's browser session when viewing the affected page.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor DNS TXT record responses for oPanel versions prior to v1.20.25. Check if raw DNS responses are reflected without sanitization in the web interface. Inspect network traffic for unexpected JavaScript payloads in TXT records. Use tools like dig or nslookup to query DNS records and analyze responses for malicious scripts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to session hijacking, theft of sensitive data such as authentication cookies, and unauthorized administrative access to oPanel. An attacker can set up a malicious DNS server to deliver a JavaScript payload that exfiltrates cookies to an attacker-controlled server with minimal user interaction required.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade oPanel to v1.20.25 or later. Implement strict input validation and output encoding for DNS responses. Disable or restrict access to the vulnerable DNS lookup/management component if not required. Monitor for unauthorized administrative access or suspicious activity.

Useful 0 Not Useful 0