CVE-2025-66508
Description
1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin's default configuration which trusts all IP addresses as proxies (TrustedProxies = 0.0.0.0/0), allowing any client to spoof the X-Forwarded-For header. Since all IP-based access controls (AllowIPs, API whitelists, localhost-only checks) rely on ClientIP(), attackers can bypass these protections by simply sending X-Forwarded-For: 127.0.0.1 or any whitelisted IP. This renders all IP-based security controls ineffective. This issue is fixed in version 2.0.14.
How to fix
- fit2cloud 1panel2.0.14 or later
- github.com/1Panel-dev/1Panel2.0.14, 2.0.14+incompatible or later
- github.com/1Panel-dev/1Panel/agent0.0.0-20251201063338-94f7d78cc976 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fit2cloud 1panel | v < 2.0.14 | 2.0.14 |
| github.com/1Panel-dev/1PanelGo | v < 2.0.14, v < 2.0.14+incompatible | 2.0.14, 2.0.14+incompatible |
| github.com/1Panel-dev/1Panel/agentGo | v < 0.0.0-20251201063338-94f7d78cc976 | 0.0.0-20251201063338-94f7d78cc976 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.