CVE-2026-50980: oPanel DNS Component XSS Vulnerability

CVE-2026-50980 Overview

CVE-2026-50980 is a Cross-Site Scripting (XSS) vulnerability affecting the DNS lookup and management component of oPanel versions prior to v1.20.25. Remote attackers can inject arbitrary JavaScript into the panel by crafting a malicious DNS TXT record. When an authenticated administrator views the DNS records through the affected component, the payload executes in the browser context. Successful exploitation enables session hijacking and unauthorized actions performed on behalf of the victim. The weakness is classified as CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary JavaScript in the oPanel administrator's browser and hijack authenticated sessions via a crafted DNS TXT record.

Affected Products

oPanel versions before v1.20.25
oPanel DNS lookup/management component
Deployments referenced by OSBIL and WomoPanel

Discovery Timeline

2026-08-28 - CVE-2026-50980 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-50980

Vulnerability Analysis

The flaw resides in how oPanel renders DNS record data returned from lookups within its administrative interface. The DNS management component fetches TXT record contents and embeds them into HTML output without proper neutralization. Because TXT records can carry arbitrary strings, an attacker who controls a DNS zone can place JavaScript payloads inside a TXT record. When the oPanel operator queries that domain through the panel, the payload is rendered and executed in the browser session.

Exploitation requires user interaction, specifically an administrator triggering a DNS lookup or viewing records that include the attacker-supplied string. The scope is changed because scripts execute in the trusted panel origin, granting access to session cookies, CSRF tokens, and any privileged panel functionality reachable from the same-origin context.

Root Cause

The root cause is missing output encoding of untrusted DNS response data before insertion into the DOM. Fields returned from external DNS resolvers are treated as safe strings rather than untrusted input. Without contextual HTML entity encoding or a strict Content Security Policy (CSP), any <script> tag or event handler embedded in a TXT record is rendered as executable markup.

Attack Vector

The attack is remote and requires no authentication on the attacker's side, but does require an authenticated oPanel user to view the malicious record. An attacker performs the following steps:

Registers or controls a domain and configures a TXT record containing a JavaScript payload.
Induces an oPanel administrator to look up or manage that domain through the DNS component.
Captures the exfiltrated session material or performs actions in the panel using the hijacked context.

A proof-of-concept is referenced in the GitHub PoC Repository for CVE-2026-50980. No verified exploit code is reproduced here.

Detection Methods for CVE-2026-50980

Indicators of Compromise

DNS TXT records containing HTML tags, <script> elements, or JavaScript event handlers such as onerror= or onload=.
Outbound requests from administrator browsers to unfamiliar domains shortly after DNS lookups in the panel.
Unexpected panel actions performed by administrator accounts without corresponding interactive sessions.

Detection Strategies

Inspect oPanel access logs for DNS lookup requests followed by anomalous administrative API calls from the same session.
Alert on HTTP responses from the DNS management endpoint that contain unescaped angle brackets or script tokens.
Deploy browser-side CSP violation reporting on the oPanel origin to surface inline script execution attempts.

Monitoring Recommendations

Monitor DNS resolution traffic originating from the oPanel host for lookups against attacker-controlled or newly registered domains.
Track administrator session cookies for reuse from unexpected IP addresses, which may indicate hijacking.
Retain oPanel web server logs and correlate DNS queries with subsequent state-changing panel operations.

How to Mitigate CVE-2026-50980

Immediate Actions Required

Upgrade oPanel to version v1.20.25 or later on all managed hosts.
Restrict administrative access to the panel by IP allowlist or VPN until the upgrade is applied.
Rotate administrator credentials and invalidate active panel sessions after patching.

Patch Information

The vulnerability is resolved in oPanel v1.20.25. Operators should review vendor references at OSBIL and WomoPanel for release artifacts, and consult the GitHub PoC Repository for CVE-2026-50980 for reproduction details when validating remediation.

Workarounds

Avoid using the oPanel DNS lookup feature against untrusted or externally controlled domains until the update is deployed.
Enforce a strict Content Security Policy on the panel origin that disallows inline scripts and unknown script sources.
Front the panel with a reverse proxy that strips or encodes suspicious characters in JSON and HTML responses containing DNS record fields.

bash

# Example CSP header to reduce XSS impact on the oPanel origin
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'";