Vulnerability Description
Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint (apps/api/src/controllers/tools.controller.ts). The endpoint passes a user-supplied url query parameter to fetchWithRedirects() and performs server-side HTTP requests to arbitrary URLs without any SSRF/IP validation. An unauthenticated remote attacker can access cloud instance metadata endpoints, probe internal services, scan internal network ports, and read returned content (status code, page size, timing, and parsed HTML metadata), and leak internal IP addresses (via getIPInfo() to a third party).
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-r3jv-rmrg-j3
- https://www.vulncheck.com/advisories/openpanel-before-2.3.0-ssrf-via-site-checke
FAQ
What is CVE-2026-85609?
CVE-2026-85609 is a vulnerability with a CVSS score of 7.5 (HIGH). Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint (apps/api/src/controllers/tools.controller.ts). Th...
How severe is CVE-2026-85609?
CVE-2026-85609 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-85609?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.