OpenPanel CVE-2026-85612

No special conditions - remote unauthenticated exploitation against any internet-exposed OpenPanel instance before 2.3.0. The /misc/favicon and /misc/og HTTP endpoints must be network-reachable (standard default deployment). No authentication, account registration, or session is required. Exploitation is limited to confidentiality impact: an attacker cannot directly write data or crash the service through this vector. The highest-impact exploitation path - cloud metadata credential theft - additionally requires the host to be deployed on a cloud provider with an instance metadata service and IMDSv1 enabled or IMDSv2 not enforced; on bare-metal or environments with strict egress filtering, impact degrades to internal network enumeration only.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) accurately represents the threat: zero preconditions, no authentication, fully automated exploitation, and high confidentiality impact. No exploit complexity is introduced because the SSRF is a direct reflection - no timing dependency, no brute-force, no race condition. The critical real-world risk vector is cloud infrastructure: OpenPanel instances deployed on AWS, GCP, or Azure with IMDSv1 (non-IMDSv2 hop-limit protected) metadata services expose IAM role credentials in a single unauthenticated HTTP request. Even a mid-sized hosting operator in gliwice running OpenPanel on shared cloud infrastructure should treat this as urgent, since stolen instance-role credentials often carry broad production permissions. EPSS data is not provided in the input; given the simplicity of exploitation and the well-understood cloud-metadata abuse pattern, real-world risk likely exceeds what raw EPSS would imply. No CISA KEV listing and no confirmed POC are identified, which moderates urgency slightly - but the ease of discovery and exploitation makes independent re-discovery likely.

An unauthenticated attacker sends a GET request to https://target-openpanel-instance/misc/favicon?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/ against an OpenPanel instance running on AWS EC2 with IMDSv1 enabled; the server fetches the metadata endpoint and returns the IAM role name in the response body. The attacker then issues a second request appending the role name to retrieve a full set of temporary AWS access key, secret key, and session token - granting lateral access to any AWS resources the instance role can reach. No exploit code is confirmed publicly, but the attack pattern is well-documented and requires no special tooling.