CVE-2026-85609 Details
Description
Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint (apps/api/src/controllers/tools.controller.ts). The endpoint passes a user-supplied url query parameter to fetchWithRedirects() and performs server-side HTTP requests to arbitrary URLs without any SSRF/IP validation. An unauthenticated remote attacker can access cloud instance metadata endpoints, probe internal services, scan internal network ports, and read returned content (status code, page size, timing, and parsed HTML metadata), and leak internal IP addresses (via getIPInfo() to a third party).
A server-side request forgery (SSRF) vulnerability has been identified in Openpanel versions prior to 2.3.0. This vulnerability allows unauthenticated attackers to send requests to arbitrary URLs via the '/tools/site-checker' endpoint. The endpoint does not validate the user-supplied URL, enabling access to cloud metadata, internal services, and network ports, while also leaking internal IP addresses to a third party.
Users are advised to update Openpanel to version 2.3.0 or later, and to add server-side request forgery protections to the site checker endpoint.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-r3jv-rmrg-j395 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/openpanel-before-2.3.0-ssrf-via-site-checker-endpoint | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Openpanel | >= 0, < 2.3.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |