CVE-2026-85612
Received Received - Intake

Unauthenticated SSRF in OpenPanel API via URL Parameter

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrary internal hosts and cloud metadata endpoints, with small responses returned verbatim enabling credential theft and internal service enumeration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85612
EUVD
EUVD-2026-71031

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openpanel openpanel to 2.3.0 (exc)
openpanel openpanel 2.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenPanel before version 2.3.0 has an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /misc/favicon and /misc/og endpoints. These endpoints accept a user-supplied 'url' parameter without proper validation, allowing attackers to force the server to make HTTP requests to arbitrary internal hosts or cloud metadata endpoints. Small responses are returned directly to the attacker, enabling credential theft and internal service enumeration.

Detection Guidance

Check OpenPanel logs for unusual requests to /misc/favicon or /misc/og endpoints with external or internal URLs. Use network monitoring tools to detect outbound requests from OpenPanel to unexpected hosts, especially cloud metadata endpoints like 169.254.169.254. Test by sending crafted requests to these endpoints with various URLs to observe if the server fetches them.

  • Monitor logs for patterns like GET /misc/favicon?url=http://<internal-ip> or similar requests.
  • Use tools like curl to probe the endpoints: curl -v http://<openpanel-server>/misc/favicon?url=http://169.254.169.254/latest/meta-data/
Impact Analysis

This vulnerability can allow attackers to steal credentials by accessing cloud metadata services like AWS IMDS, read internal service responses, or probe internal networks. Attackers can also bypass security controls to access restricted resources, potentially leading to data breaches or further exploitation of internal systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade OpenPanel to version 2.3.0 or later immediately to patch the vulnerability. If upgrading is not possible, disable the /misc/favicon and /misc/og endpoints or restrict access to authenticated users only. Implement IP/hostname filtering to block requests to internal or cloud metadata endpoints. Disable automatic redirect following in the server configuration.

  • Apply network-level controls to prevent OpenPanel from making outbound requests to private or cloud metadata IP ranges.
  • Review and update firewall rules to restrict outbound traffic from the OpenPanel server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85612. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart