CVE-2026-85612

Name of the Vulnerable Software and Affected Versions OpenPanel versions prior to 2.3.0

Description An unauthenticated server-side request forgery (SSRF) issue exists where the application fails to properly validate the url parameter. This allows attackers to force the API to fetch arbitrary internal hosts and cloud metadata endpoints via the '/misc/favicon' and '/misc/og' endpoints. Because small responses are returned verbatim, this can lead to internal service enumeration and the theft of credentials.

Recommendations Update to version 2.3.0 or later. As a temporary workaround, restrict access to the '/misc/favicon' and '/misc/og' endpoints.