CVE-2026-88892 affects all versions of OpenPanel. The data importer fetches URLs supplied by authenticated users using a plain fetch call instead of the project's SSRF protection utility. The URL parameter is only validated as a syntactically valid URL, allowing requests to internal IP addresses such as 127.0.0.1 or 169.254.169.254. An authenticated organization member, including those with minimal access, can exploit this to make the server perform HTTP requests to arbitrary internal or external endpoints. The server's HTTP response status and status text are saved and returned to the user, providing a feedback channel for internal network scanning. If the response is formatted as Umami CSV, it is ingested as analytics events, exposing internal data to the attacker. There is no patch or fix available at the time of disclosure.

An authenticated user can exploit this SSRF vulnerability to scan internal network hosts, ports, and paths by causing the server to fetch arbitrary URLs. This can lead to information disclosure about internal infrastructure. Additionally, internal responses formatted as Umami CSV can be ingested as analytics events, exposing internal data to the attacker. The vulnerability does not allow direct code execution or denial of service but can facilitate further attacks by revealing internal network details.

No official fix or patch is available at the time of publication. Users should monitor the vendor's advisory for updates. As a temporary mitigation, restrict access to the data importer functionality to trusted users only and consider network-level controls to limit the server's ability to make arbitrary outbound HTTP requests. Validate and sanitize user-supplied URLs more strictly before fetching. Avoid exposing internal response data to users.