7.5Yüksek
CVE-2026-85612OpenPanel before 2.3.0 SSRF via favicon and og endpoints
Açıklama
OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrary internal hosts and cloud metadata endpoints, with small responses returned verbatim enabling credential theft and internal service enumeration.
Zayıflık türü (CWE):
CWE-918
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| openpanel | openpanel | < 2.3.0 | |
| Openpanel-dev | openpanel | < 2.3.0, fixed 2.3.0 |
Kaynaklar ve yamalar
- GitHub Security Advisory (GHSA-2hff-m67f-2w2w) vendor-advisory
- VulnCheck Advisory: OpenPanel before 2.3.0 SSRF via favicon and og endpoints third-party-advisory