CVE-2026-85609: Openpanel SSRF Vulnerability

CVE-2026-85609 Overview

CVE-2026-85609 is an unauthenticated server-side request forgery (SSRF) vulnerability in Openpanel versions before 2.3.0. The flaw exists in the GET /tools/site-checker endpoint implemented in apps/api/src/controllers/tools.controller.ts. The endpoint forwards a user-supplied url query parameter directly to fetchWithRedirects() and performs server-side HTTP requests to arbitrary destinations without IP or scheme validation. A remote attacker can reach cloud instance metadata services, probe internal hosts, enumerate internal network ports, and read response content including status codes, page size, timing data, and parsed HTML metadata. The classification maps to [CWE-918].

Critical Impact
Unauthenticated attackers can pivot into internal networks, extract cloud metadata credentials, and enumerate services behind the Openpanel host without any authentication or user interaction.

Affected Products

Openpanel versions prior to 2.3.0
The vulnerable apps/api/src/controllers/tools.controller.ts API controller
Self-hosted Openpanel deployments exposing the /tools/site-checker endpoint

Discovery Timeline

2026-09-04 - CVE-2026-85609 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85609

Vulnerability Analysis

The vulnerability resides in the site checker feature of the Openpanel API. When a client issues GET /tools/site-checker?url=<target>, the controller passes the attacker-controlled URL into fetchWithRedirects() and executes the outbound HTTP request from the server. No allowlist, denylist, DNS resolution check, or IP range validation is applied before the request is issued.

Because the endpoint returns response metadata to the caller, including HTTP status code, page size, request timing, and parsed HTML metadata, it functions as a full-read SSRF primitive. The endpoint also invokes getIPInfo() against a third-party service, leaking internal IP addresses resolved during the fetch.

Redirect following expands the attack surface. An attacker can host an external redirector that forwards the server to http://169.254.169.254/ or other internal endpoints, bypassing naive URL parsing that only inspects the initial request.

Root Cause

The root cause is missing input validation on the url query parameter. The controller trusts user-supplied URLs and delegates fetching to a helper that follows redirects without host or IP restrictions. There is no check for private address ranges (RFC1918), link-local addresses (169.254.0.0/16), loopback, or metadata service hosts before the outbound request is made.

Attack Vector

Exploitation requires only network access to the Openpanel API. An unauthenticated attacker sends a crafted GET request targeting internal resources through the /tools/site-checker endpoint. Typical targets include cloud instance metadata endpoints such as the AWS IMDS at 169.254.169.254, GCP and Azure equivalents, internal admin panels bound to loopback, and TCP services on the internal network. Response bodies, sizes, and timing differences allow the attacker to enumerate hosts and services and to exfiltrate metadata content.

No verified public exploit code is available. Refer to the GitHub Security Advisory and the VulnCheck Advisory for Openpanel SSRF for further technical detail.

Detection Methods for CVE-2026-85609

Indicators of Compromise

Access log entries for GET /tools/site-checker containing url= parameters pointing to private address ranges, localhost, 127.0.0.1, or 169.254.169.254.
Outbound HTTP requests from the Openpanel host to cloud metadata endpoints or internal-only IP ranges shortly after inbound requests to /tools/site-checker.
Unusual outbound connections from the API process to getIPInfo() third-party services correlated with suspicious url parameters.

Detection Strategies

Alert on any /tools/site-checker request whose url parameter resolves to RFC1918, loopback, or link-local addresses.
Compare inbound request URLs to subsequent outbound DNS and HTTP activity from the Openpanel host to identify SSRF chains through redirects.
Baseline expected external destinations for the API service and alert on deviations, including new connections to metadata endpoints.

Monitoring Recommendations

Enable verbose HTTP access logging on the Openpanel API and forward logs to a centralized analytics platform.
Capture egress netflow or proxy logs from the host running Openpanel to detect internal probing.
Monitor cloud provider metadata service access counters where available (for example, IMDSv2 request metrics on AWS).

How to Mitigate CVE-2026-85609

Immediate Actions Required

Upgrade Openpanel to version 2.3.0 or later, which addresses the missing SSRF validation.
Restrict inbound network access to the /tools/site-checker endpoint using a reverse proxy or web application firewall until patching is complete.
On AWS deployments, enforce IMDSv2 and set a low hop limit so containerized workloads cannot reach metadata through SSRF.

Patch Information

Upgrade to Openpanel 2.3.0 or later. The fix and vendor guidance are documented in the GitHub Security Advisory GHSA-r3jv-rmrg-j395. Additional advisory context is available from the VulnCheck Advisory for Openpanel SSRF.

Workarounds

Block requests to /tools/site-checker at the reverse proxy or WAF layer until the upgrade is applied.
Enforce egress filtering from the Openpanel host to deny outbound traffic to RFC1918, loopback, and link-local ranges, including 169.254.169.254.
Deploy the API behind a network segment that cannot route to internal management or metadata services.

bash

# Example nginx rule to block the vulnerable endpoint pending upgrade
location /tools/site-checker {
    return 403;
}