CVE-2026-85614

High

Description

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue requests to internal services, localhost, and cloud metadata endpoints, reading internal HTTP response titles, headers, status codes, and SSL certificate information.

SeverityHigh

CVSS8.6

Exploit probability—

Product

Openpanel

PublishedSep 4, 2026

First seenSep 4, 2026

Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Update

Openpanel-dev openpanel2.3.0 or later

Vendor advisories

github.com/Openpanel-dev/openpanel/security/advisories/GHSA-gqcr-xgfj-pq29

Affected products

Product	Affected versions	Fixed in
Openpanel-dev openpanel	v < 2.3.0	2.3.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.