CVE-2026-88892 describes an SSRF vulnerability in Openpanel's data importer component. The importer calls fetch() on user-supplied URLs validated only by a basic URL string check, bypassing the project's existing SSRF guard. Authenticated organization members, including those with minimal access, can cause the server to make HTTP requests to arbitrary internal or external addresses reachable from the server. The HTTP response status and text are stored and returned to the user, enabling internal host and port scanning. Additionally, if the internal response matches the expected CSV format, it is ingested as analytics events, exposing internal data to the attacker. No official fix or patch is available at the time of publication.

An authenticated user with organization membership can exploit this SSRF vulnerability to scan internal network hosts and ports by causing the server to make arbitrary HTTP requests. The attacker can also cause internal responses to be ingested as analytics events, potentially exposing sensitive internal information through the analytics interface. This can lead to information disclosure and internal network reconnaissance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict organization member permissions to trusted users only and monitor for suspicious import activity. Avoid supplying untrusted URLs to the data importer. Implement network-level controls to limit server outbound HTTP requests if possible.