CVE-2026-85614
Received Received - Intake

Unauthenticated SSRF in OpenPanel via Site Checker Endpoint

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue requests to internal services, localhost, and cloud metadata endpoints, reading internal HTTP response titles, headers, status codes, and SSL certificate information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85614
EUVD
EUVD-2026-71033

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openpanel openpanel to 2.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85614 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in OpenPanel versions before 2.3.0. It exists in the GET /tools/site-checker endpoint, which accepts a user-controlled URL parameter without proper validation. Attackers can force the server to make HTTP requests to internal services, localhost, or cloud metadata endpoints and retrieve response details like titles, headers, status codes, and SSL certificates.

Detection Guidance

To detect this vulnerability, monitor network traffic for unusual outbound requests from your OpenPanel server, especially to internal IPs or cloud metadata endpoints. Check logs for repeated requests to the /tools/site-checker endpoint with arbitrary URLs. Use tools like curl to test the endpoint manually: curl -v 'http://<openpanel-server>/tools/site-checker?url=http://169.254.169.254/latest/meta-data/' to see if it leaks metadata.

Inspect server logs for SSRF indicators such as requests to localhost, private IP ranges, or unexpected external domains. Enable verbose logging for the OpenPanel API to capture detailed request and response headers.

Impact Analysis

This vulnerability allows attackers to scan internal networks, access sensitive cloud metadata (e.g., 169.254.169.254), and gather confidential information from internal services. It can lead to confidentiality breaches, internal service exposure, and network reconnaissance without requiring authentication or user interaction.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal services or cloud metadata endpoints, potentially exposing sensitive data such as HTTP response headers, titles, or SSL certificates. For GDPR, this may violate principles of data confidentiality and integrity if personal data is exposed. For HIPAA, unauthorized access to internal systems could compromise protected health information if such systems are part of the healthcare infrastructure.

Mitigation Strategies

Immediately upgrade OpenPanel to version 2.3.0 or later to patch the SSRF flaw. If upgrading is not possible, restrict access to the /tools/site-checker endpoint via firewall rules or network segmentation. Disable the endpoint entirely if unused.

Implement private IP filtering and DNS-rebinding protections. Block outbound requests to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (e.g., 169.254.169.254).

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85614. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart