CVE-2026-88892
Deferred Deferred - Pending Action

SSRF in OpenPanel Data Importer via Unsafe Fetch

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
OpenPanel is an analytics platform. In all versions (no patched release available at time of publication), the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard (apps/api/src/utils/safe-fetch.ts). In packages/importer/src/providers/umami.ts, parseRemoteFile calls fetch() on config.fileUrl, which is validated only by z.string().url(), so values such as http://127.0.0.1:9911/ or http://169.254.169.254/latest/meta-data/ are accepted; the shared createFileImportConfig factory gives the plausible provider the same field. An authenticated organization member — including a default 'member' with no project_access rows, for whom the intended access-level check is skipped because getProjectAccess returns boolean true rather than a level object — can therefore make the server connect to any address reachable from it. The resulting HTTP status and status text are persisted as Import.errorMessage and returned by import.get to the same user, providing a scanning oracle for internal hosts, ports and paths; if an internal response parses as Umami CSV, its rows are ingested as events and become readable in the attacker's analytics views.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88892
EUVD
EUVD-2026-75442

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openpanel openpanel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88892 is a Server-Side Request Forgery (SSRF) vulnerability in OpenPanel, an analytics platform. The data importer fetches user-supplied URLs using an unguarded fetch call instead of the platform's existing SSRF protection. This allows authenticated organization members to force the server to connect to any reachable address, including internal hosts, by bypassing URL validation that only checks basic URL format.

Detection Guidance

To detect this SSRF vulnerability in OpenPanel, monitor network traffic for outbound connections from the OpenPanel server to internal or unexpected external addresses. Check logs for fetch requests to localhost, link-local addresses (169.254.0.0/16), or private IP ranges. Look for Import.errorMessage entries containing HTTP status codes from internal hosts.

Impact Analysis

An attacker with authenticated access can scan internal networks to identify accessible hosts, ports, and paths using HTTP status codes returned in error messages. If an internal response contains Umami CSV data, it may be ingested as events visible in the attacker's analytics views. This enables reconnaissance and potential data exposure within the internal network.

Compliance Impact

This vulnerability could lead to unauthorized access to internal systems and data exposure, violating compliance requirements for data protection and access controls in standards like GDPR and HIPAA. The ability to scan internal networks and ingest internal data without authorization may result in regulatory penalties and loss of trust.

Mitigation Strategies

Immediately restrict the importer's fetch functionality by applying the existing SSRF guard from safe-fetch.ts to the data importer. Block internal and non-public IP addresses in URL validation. Disable the importer's ability to fetch arbitrary URLs until a patch is applied. Review and remove default 'member' roles with excessive permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88892. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart