CVE-2026-85614

Name of the Vulnerable Software and Affected Versions OpenPanel versions prior to 2.3.0

Description An unauthenticated server-side request forgery (SSRF) exists in the 'GET /tools/site-checker' endpoint. The issue occurs because the endpoint accepts a client-controlled URL parameter without implementing private IP filtering or DNS-rebinding protection. This allows attackers to force the server to send requests to internal services, localhost, and cloud metadata endpoints, enabling the retrieval of internal HTTP response titles, headers, status codes, and SSL certificate information.

Recommendations Update to version 2.3.0 or later. Avoid using the URL parameter in the 'GET /tools/site-checker' endpoint until the update is applied.