CVE-2026-85614

Sažetak

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue requests to internal services, localhost, and cloud metadata endpoints, reading internal HTTP response titles, headers, status codes, and SSL certificate information.

Reference

https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-gqcr-xgfj-pq29
https://www.vulncheck.com/advisories/openpanel-api-before-2.3.0-unauthenticated-ssrf-via-site-checker

CVSS

Base:	8.6
Impact:	4.0
Exploitability:	3.9

Pristup

Vektor	Složenost	Autentikacija
NETWORK	LOW	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
HIGH	NONE	NONE

CVSS vektor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Zadnje važnije ažuriranje

04-09-2026 - 13:20

Objavljeno

04-09-2026 - 12:17