CVE-2026-85614: critical vulnerability in Openpanel-dev openpanel
OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.2epss 0.3%
OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue requests to internal services, localhost, and cloud metadata endpoints, reading internal HTTP response titles, headers, status codes, and SSL certificate information.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
Openpanel-dev · openpanelRelated CVEs — Openpanel-dev openpanel
In the same product, most dangerous first.
CVE-2026-85610HIGHOpenPanel before 2.3.0 Remote Code Execution via chart formulasEPSS 0.7%CVE-2026-93985CRITICALOpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCEEPSS 0.7%CVE-2026-85609MEDIUMOpenpanel before 2.3.0 SSRF via Site Checker EndpointEPSS 0.5%CVE-2026-116811HIGHOpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript TemplateEPSS 0.5%CVE-2026-88893HIGHOpenPanel through 2.3.0 Unauthenticated Share Lookup Information DisclosureEPSS 0.5%CVE-2026-88891HIGHOpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via MutationsEPSS 0.4%