CVE-2026-85614: OpenPanel Unauthenticated SSRF Vulnerability

CVE-2026-85614 Overview

CVE-2026-85614 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in OpenPanel versions prior to 2.3.0. The flaw exists in the GET /tools/site-checker endpoint, which accepts a client-controlled URL parameter without validating the destination. The endpoint lacks private IP filtering and DNS-rebinding protection, allowing attackers to coerce the OpenPanel server into issuing requests to internal services, localhost, and cloud metadata endpoints. Attackers can read HTTP response titles, headers, status codes, and SSL certificate information from targeted internal resources. The vulnerability is tracked under [CWE-918] Server-Side Request Forgery.

Critical Impact
Unauthenticated attackers can pivot into internal networks and extract sensitive data from cloud instance metadata services (IMDS), enabling potential credential theft and lateral movement.

Affected Products

OpenPanel versions prior to 2.3.0
OpenPanel API /tools/site-checker endpoint
Deployments exposing the OpenPanel management interface to untrusted networks

Discovery Timeline

2026-09-04 - CVE-2026-85614 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85614

Vulnerability Analysis

The vulnerability resides in the OpenPanel API endpoint GET /tools/site-checker. This endpoint is designed to perform diagnostic checks against user-supplied URLs. It does not require authentication and accepts the target URL as a fully client-controlled parameter.

OpenPanel fails to enforce restrictions on the destination address. The server accepts URLs pointing to loopback interfaces, RFC1918 private ranges, link-local addresses, and cloud provider metadata endpoints such as 169.254.169.254. Once the request completes, the server returns HTTP response titles, headers, status codes, and SSL certificate metadata to the caller.

Because the response data flows back to the attacker, the SSRF is a full read primitive rather than blind. Attackers can enumerate internal services, fingerprint applications, and extract cloud IAM credentials from metadata endpoints.

Root Cause

The root cause is missing input validation on the URL parameter. OpenPanel does not resolve the hostname before issuing the request, does not compare the resolved address against a deny list of private and reserved ranges, and does not re-validate the address after resolution. The absence of DNS-rebinding protection also allows attackers to bypass any hostname-based checks by returning a public address on first lookup and a private address on subsequent lookups.

Attack Vector

Exploitation requires only network access to the OpenPanel API. An unauthenticated attacker issues a crafted GET request to /tools/site-checker with a URL parameter pointing to an internal target. The OpenPanel server issues the outbound request from its own network position and returns the response metadata to the attacker. High-value targets include AWS, GCP, and Azure metadata endpoints, internal admin panels, and databases exposed on loopback.

No verified public exploit code is available at the time of writing. See the GitHub Security Advisory and the VulnCheck SSRF Advisory for additional technical detail.

Detection Methods for CVE-2026-85614

Indicators of Compromise

Unauthenticated GET requests to /tools/site-checker from unexpected source IPs in OpenPanel access logs
Outbound requests from the OpenPanel host to 169.254.169.254, 127.0.0.1, or RFC1918 addresses
Anomalous DNS queries from the OpenPanel server resolving attacker-controlled hostnames that return private IPs
Spikes in response payloads containing internal service banners or certificate metadata

Detection Strategies

Alert on any request to /tools/site-checker where the URL parameter targets loopback, link-local, private, or cloud metadata address ranges
Correlate inbound API requests with outbound server-initiated connections to identify SSRF chains
Monitor for repeated /tools/site-checker calls from a single source, indicating internal port scanning

Monitoring Recommendations

Enable verbose logging on the OpenPanel API layer and forward logs to a centralized SIEM
Deploy network egress monitoring on the OpenPanel host, especially for traffic toward 169.254.169.254
Baseline normal outbound destinations from the OpenPanel server and alert on deviations

How to Mitigate CVE-2026-85614

Immediate Actions Required

Upgrade OpenPanel to version 2.3.0 or later without delay
Restrict inbound network access to the OpenPanel management interface using firewall rules or a reverse proxy allowlist
Rotate any cloud IAM credentials, API keys, or tokens accessible from the OpenPanel host's instance metadata service
Audit access logs for prior requests to /tools/site-checker and investigate anomalies

Patch Information

The vulnerability is fixed in OpenPanel 2.3.0. Refer to the GitHub Security Advisory GHSA-gqcr-xgfj-pq29 for release details and remediation guidance.

Workarounds

Block or remove the /tools/site-checker route at a reverse proxy such as nginx or Caddy until the upgrade is applied
Enforce IMDSv2 on AWS EC2 instances to require session tokens for metadata access, reducing SSRF exposure
Deploy egress firewall rules on the OpenPanel host that deny outbound traffic to 169.254.169.254 and private ranges the server should not contact
Place the OpenPanel host behind an outbound proxy that enforces destination allowlists

bash

# Example nginx rule to block the vulnerable endpoint pre-patch
location /tools/site-checker {
    deny all;
    return 403;
}