CVE-2026-85612 Overview
CVE-2026-85612 is an unauthenticated server-side request forgery (SSRF) vulnerability in OpenPanel versions prior to 2.3.0. The flaw resides in the /misc/favicon and /misc/og endpoints, which accept an attacker-supplied url parameter without adequate validation. Attackers can coerce the API into fetching arbitrary internal hosts and cloud metadata endpoints. Small responses are returned verbatim, enabling credential theft and internal service enumeration. The vulnerability is categorized under [CWE-918] Server-Side Request Forgery.
Critical Impact
Unauthenticated attackers can retrieve cloud instance credentials from metadata services and map internal network infrastructure through the vulnerable OpenPanel API.
Affected Products
- OpenPanel versions prior to 2.3.0
- /misc/favicon endpoint
- /misc/og endpoint
Discovery Timeline
- 2026-09-04 - CVE-2026-85612 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-85612
Vulnerability Analysis
OpenPanel exposes two API endpoints intended to fetch remote assets on behalf of the application. The /misc/favicon endpoint retrieves site favicons, and the /misc/og endpoint fetches Open Graph metadata. Both accept a user-controlled url parameter. Neither endpoint enforces sufficient allowlisting, scheme restrictions, or IP address filtering before making the outbound HTTP request.
Because the endpoints do not require authentication, any remote attacker can trigger server-initiated requests. Small response bodies are proxied back to the caller verbatim. This turns the application into an SSRF oracle usable against loopback services, RFC 1918 ranges, and cloud provider metadata IPs such as 169.254.169.254.
Root Cause
The root cause is missing validation of the url parameter [CWE-918]. The endpoints do not verify that the target host resolves outside internal ranges, do not restrict schemes to http/https against public IPs, and do not filter redirect chains that could pivot to internal destinations after an allowed initial hop.
Attack Vector
Exploitation requires only network access to the OpenPanel API. An attacker sends a crafted GET request to /misc/favicon?url= or /misc/og?url= with an internal target. Common targets include AWS Instance Metadata Service (IMDSv1) at http://169.254.169.254/latest/meta-data/iam/security-credentials/, GCP metadata endpoints requiring the Metadata-Flavor header when reachable, and internal admin interfaces on private subnets. Because responses are returned verbatim for small payloads, attackers can exfiltrate temporary IAM credentials and enumerate internal services without additional tooling.
No public proof-of-concept exploit code is verified at this time. Refer to the GitHub Security Advisory and the VulnCheck SSRF Advisory for additional technical detail.
Detection Methods for CVE-2026-85612
Indicators of Compromise
- Outbound HTTP requests from the OpenPanel server to 169.254.169.254, metadata.google.internal, or metadata.azure.com.
- Web server access logs containing /misc/favicon?url= or /misc/og?url= with parameter values referencing private IP ranges, localhost, or 127.0.0.1.
- Unexpected outbound connections from the OpenPanel process to internal-only services on ports such as 6379 (Redis), 5432 (PostgreSQL), 9200 (Elasticsearch), or 8500 (Consul).
Detection Strategies
- Deploy web application firewall rules that inspect the url query parameter on /misc/* endpoints and block requests targeting RFC 1918, loopback, and link-local ranges.
- Correlate access logs with egress netflow data to identify SSRF pivots originating from the OpenPanel host.
- Alert on any process on the OpenPanel server initiating requests to cloud metadata IP addresses.
Monitoring Recommendations
- Enable verbose HTTP request logging on the OpenPanel API tier, including full query strings, and forward to a centralized log platform.
- Instrument egress firewalls to log and alert on connections from the application host to metadata service IP addresses.
- Monitor for anomalous cloud API activity using credentials associated with the OpenPanel instance role, such as calls from unfamiliar source IPs.
How to Mitigate CVE-2026-85612
Immediate Actions Required
- Upgrade OpenPanel to version 2.3.0 or later, which contains the vendor fix.
- Enforce IMDSv2 on AWS instances hosting OpenPanel to require session tokens for metadata access.
- Restrict egress traffic from the OpenPanel host, blocking access to 169.254.169.254 and internal management subnets except where required.
- Rotate any IAM credentials or API tokens accessible from the affected instance if exploitation is suspected.
Patch Information
The OpenPanel maintainers addressed CVE-2026-85612 in version 2.3.0. Details are published in the GitHub Security Advisory GHSA-2hff-m67f-2w2w. Administrators should upgrade to 2.3.0 or later as the primary remediation.
Workarounds
- Place the OpenPanel API behind a reverse proxy that strips or validates the url parameter on /misc/favicon and /misc/og requests.
- Deploy an egress proxy that denies connections to private, loopback, and link-local address ranges from the application host.
- Require authentication in front of the OpenPanel API where the deployment topology permits, reducing unauthenticated exposure.
# Example iptables rule blocking egress to AWS metadata service from the OpenPanel host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
