CVE-2026-85614: Server-Side Request Forgery (SSRF) in Openpanel-dev openpanel

CVE-2026-85614 describes an unauthenticated SSRF vulnerability in OpenPanel prior to version 2.3.0. The vulnerability exists in the GET /tools/site-checker endpoint, which accepts a URL parameter controlled by the client without any filtering of private IP addresses or DNS rebinding protections. This allows attackers to coerce the OpenPanel server into making HTTP requests to internal network resources, including localhost and cloud metadata services, thereby exposing sensitive internal response data such as HTTP titles, headers, status codes, and SSL certificate details. The CVSS 4.0 score is 9.2, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality.

An attacker can exploit this SSRF vulnerability to make the OpenPanel server send arbitrary HTTP requests to internal or protected network resources. This can lead to information disclosure of internal service details, cloud metadata endpoints, and SSL certificate information. The vulnerability does not require authentication or user interaction, increasing its risk. However, no known exploits in the wild have been reported as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix link is provided, users should monitor OpenPanel vendor communications for updates. Until a fix is available, restrict access to the vulnerable endpoint and implement network-level protections to limit the server's ability to make arbitrary outbound requests.