CVE-2026-85614
OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue requests to internal services, localhost, and cloud metadata endpoints, reading internal HTTP response titles, headers, status codes, and SSL certificate information.
- Published Sep 4, 2026
- CVSS 9.2 critical
- 0.3% chance of exploitation in the next 30 days (EPSS)
- A fix is available