CVE-2026-85609: Openpanel before 2.3.0 SSRF via Site Checker Endpoint
Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint (apps/api/src/controllers/tools.controller.ts). The endpoint passes a user-supplied url query parameter to fetchWithRedirects() and performs server-side HTTP requests to arbitrary URLs without any SSRF/IP validation. An unauthenticated remote attacker can access cloud instance metadata endpoints, probe internal services, scan internal network ports, and read returned content (status code, page size, timing, and parsed HTML metadata), and leak internal IP addresses (via getIPInfo() to a third party).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can reach the Openpanel GET /tools/site-checker endpoint can supply a URL for the server to request. No privileges or user interaction are required.
What information or systems could be exposed?
An attacker can use the server as a proxy to reach cloud instance metadata endpoints, probe internal services, and scan internal network ports. The endpoint returns request-derived information including status code, page size, timing, parsed HTML metadata, and returned content; it can also leak internal IP addresses to a third party through getIPInfo().
Are default deployments affected?
The available data identifies the issue as a missing SSRF/IP validation condition in the unauthenticated site-checker endpoint. It does not describe a configuration change or access control setting that disables the affected behavior.
What version should be remediated?
Upgrade Openpanel to version 2.3.0 or later. Versions before 2.3.0 are identified as affected.