CVE-2025-66508: Fit2cloud 1Panel Auth Bypass Vulnerability

CVE-2025-66508 Overview

CVE-2025-66508 affects 1Panel, an open-source web-based control panel for Linux server management developed by fit2cloud. Versions 2.0.14 and below inherit the Gin framework's default proxy configuration, which sets TrustedProxies = 0.0.0.0/0. This configuration instructs the HTTP router to trust every client as a legitimate proxy. Any remote attacker can therefore forge the X-Forwarded-For header to spoof a whitelisted source address. Because 1Panel's IP-based controls (AllowIPs, API whitelists, and localhost-only checks) rely on ClientIP(), the spoofed header is honored. The maintainers addressed the flaw in version 2.0.14.

Critical Impact
Attackers can send X-Forwarded-For: 127.0.0.1 to bypass every IP allowlist protecting the 1Panel management interface and its APIs.

Affected Products

fit2cloud 1Panel versions 2.0.14 and earlier
1Panel Community Edition running default Gin proxy configuration
Any 1Panel deployment relying on AllowIPs or API IP whitelists for access control

Discovery Timeline

2025-12-09 - CVE-2025-66508 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66508

Vulnerability Analysis

The vulnerability is an authentication bypass by spoofed source identifier, classified as [CWE-290]. 1Panel builds its HTTP layer on the Gin web framework. Gin exposes a ClientIP() helper that resolves the request source by inspecting the X-Forwarded-For and X-Real-IP headers when the connection originates from a trusted proxy. The list of trusted proxies is governed by the TrustedProxies setting.

1Panel did not override the Gin default, which trusts the entire IPv4 range 0.0.0.0/0. Every direct client is therefore treated as a legitimate reverse proxy. When ClientIP() runs, it returns whatever address the caller places in the leftmost X-Forwarded-For entry instead of the true TCP peer address. Because the same helper feeds the AllowIPs check, API whitelisting logic, and localhost-only administrative endpoints, a single forged header defeats all of these controls at once.

Root Cause

The root cause is an insecure default configuration. Gin's engine.SetTrustedProxies was never called with a restricted CIDR, so TrustedProxies remained 0.0.0.0/0. The framework's contract requires operators to narrow this list to the actual reverse proxy addresses before the header-derived client IP can be trusted.

Attack Vector

The attack requires no authentication, no privileges, and no user interaction. An attacker sends an HTTP request to the exposed 1Panel service and injects an X-Forwarded-For header containing an address that the target has whitelisted. Common bypass values include 127.0.0.1, an internal management subnet address, or any address permitted by AllowIPs. The server logs and access decisions then treat the request as if it originated from the trusted source.

// Patch fragments from commit 94f7d78cc9768ee244da33e09408017d1f68b5ed
// agent/init/migration/migrate.go - registers a migration that
// enforces corrected iptables and trust state on upgrade.

		migrations.UpdateDatabase,
		migrations.AddGPUMonitor,
		migrations.UpdateDatabaseMysql,
+		migrations.InitIptablesStatus,
	})
	if err := m.Migrate(); err != nil {
		global.LOG.Error(err)

Source: 1Panel GitHub Commit 94f7d78

Detection Methods for CVE-2025-66508

Indicators of Compromise

Requests arriving on the 1Panel port with an X-Forwarded-For header when no legitimate reverse proxy is deployed in front of the service.
Access log entries showing ClientIP as 127.0.0.1 or an internal address while the underlying TCP source is external.
Successful API calls to endpoints restricted by AllowIPs from users whose true network address is not on the allowlist.

Detection Strategies

Compare the TCP-level remote address recorded by the reverse proxy or firewall against the ClientIP value logged by 1Panel and alert on mismatches.
Inspect HTTP request logs for X-Forwarded-For values that contain loopback or RFC1918 addresses arriving from public interfaces.
Correlate authentication and privileged API events with the true source IP captured at the network edge rather than the application layer.

Monitoring Recommendations

Enable verbose HTTP request logging on 1Panel and forward logs to a central analytics platform for header inspection.
Baseline expected X-Forwarded-For chains when a legitimate proxy is in use and alert on unexpected structures such as single-hop loopback entries.
Track administrative actions on 1Panel and require corroborating network telemetry to confirm the source before trusting application-reported IPs.

How to Mitigate CVE-2025-66508

Immediate Actions Required

Upgrade 1Panel to version 2.0.14 or later, which restricts trusted proxies and restores the integrity of IP-based access checks.
Restrict network exposure of the 1Panel management port to trusted administrative networks using host firewalls or security groups.
Audit AllowIPs and API whitelist configurations and rotate any credentials that may have been accessed while the bypass was possible.

Patch Information

The fix is delivered in 1Panel version 2.0.14. The maintainers documented the issue in the 1Panel Security Advisory GHSA-7cqv-qcq2-r765 and shipped code changes in commit 94f7d78. Operators running any release at or below 2.0.14 without the referenced commit should upgrade before re-enabling IP-based access controls.

Workarounds

Terminate 1Panel behind a hardened reverse proxy that strips inbound X-Forwarded-For headers before they reach the application.
Replace application-layer IP allowlists with network-layer controls such as firewall rules, VPN gating, or SSH tunnels until patched.
Bind the 1Panel service to a loopback or internal interface and require an authenticated jump host for administrative access.

bash

# Nginx example: overwrite any client-supplied X-Forwarded-For
# before proxying to 1Panel so spoofed values cannot reach ClientIP().
location / {
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Real-IP       $remote_addr;
    proxy_pass http://127.0.0.1:1panel_port;
}