CVE-2026-85612: OpenPanel before 2.3.0 SSRF via favicon and og endpoints
OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrary internal hosts and cloud metadata endpoints, with small responses returned verbatim enabling credential theft and internal service enumeration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenPanelto a version that resolves this vulnerability.Fixed in 2.3.0 - Configuration
Mitigate the SSRF issue by fixing/strengthening validation for the attacker-supplied url parameter on the unauthenticated /misc/favicon and /misc/og endpoints (OpenPanel before 2.3.0); apply the vendor fix by upgrading to 2.3.0 or later.
OpenPanel /misc/favicon and /misc/og endpoints url parameter validation = insufficient validation (unspecified exact setting)
Event History
Frequently Asked Questions
Which deployments are exposed?
OpenPanel versions before 2.3.0 are affected if the /misc/favicon or /misc/og endpoints are reachable by an attacker. The vulnerability is unauthenticated, so no account or prior access is required.
What can an attacker access through the vulnerable endpoints?
An attacker can supply a URL that causes the server to fetch arbitrary internal hosts and cloud metadata endpoints. Small responses are returned verbatim, which can enable internal service enumeration and theft of credentials exposed by metadata services.
How can I determine whether an instance is vulnerable?
Check whether the deployed OpenPanel version is earlier than 2.3.0 and whether it exposes /misc/favicon or /misc/og endpoints that accept a url parameter. Affected endpoints perform insufficient validation of attacker-supplied URLs.