EUVD-2026-71028
GHSA-m7f4-qmh8-fvrx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Scope changes because the server reaches internal systems beyond itself; C:L and I:L reflect internal data disclosure and third-party IP leakage with no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint (apps/api/src/controllers/tools.controller.ts). The endpoint passes a user-supplied url query parameter to fetchWithRedirects() and performs server-side HTTP requests to arbitrary URLs without any SSRF/IP validation. An unauthenticated remote attacker can access cloud instance metadata endpoints, probe internal services, scan internal network ports, and read returned content (status code, page size, timing, and parsed HTML metadata), and leak internal IP addresses (via getIPInfo() to a third party).
AnalysisAI
Unauthenticated full-read SSRF in Openpanel before 2.3.0 enables remote attackers to issue arbitrary server-side HTTP requests through the /tools/site-checker endpoint, with no authentication, IP allowlisting, or SSRF mitigation in place. The endpoint's url query parameter is passed directly to fetchWithRedirects() in apps/api/src/controllers/tools.controller.ts, allowing attackers to reach cloud instance metadata services (e.g., AWS IMDS at 169.254.169.254), enumerate internal ports, and retrieve response content including status codes, page sizes, and parsed HTML metadata. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the CVSS 4.0 vector confirms PR:N and UI:N, and the endpoint is unauthenticated with no session or token check. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-provided CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L) correctly identifies the barrier-free network attack surface but conservatively scores subsequent-system confidentiality at SC:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Openpanel to version 2.3.0 or later, which resolves the SSRF by introducing URL and IP validation in the site-checker endpoint; the fix is confirmed in the vendor GitHub security advisory at https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-r3jv-rmrg-j395. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function. Rated h
An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function. Rated m
Cross Site Request Forgery vulnerability in Open Panel OpenAdmin v.0.3.4 allows a remote attacker to escalate privileges
Server-side request forgery in OpenPanel before 2.3.0 lets unauthenticated remote attackers coerce the panel server into
Authenticated remote code execution in OpenPanel before 2.3.0 allows any project member with read access to escape the m
Unauthenticated SSRF in OpenPanel before 2.3.0 exposes two utility endpoints - /misc/favicon and /misc/og - that blindly
Unauthenticated information disclosure in OpenPanel (openpanel-dev/openpanel) exposes argon2id password hashes and full
Cross-tenant SQL injection in OpenPanel's analytics filter builder allows authenticated attackers with project-scoped re
Unauthenticated XSS in OpenPanel before 2.3.0 allows remote attackers to execute arbitrary JavaScript in a victim's brow
OpenPanel's server-side mutation resolvers fail to enforce project access levels, allowing read-only project members to
Cross-tenant broken object level authorization (BOLA) in OpenPanel before 2.3.0 exposes confidential report definitions
Cross-tenant insecure direct object reference in Openpanel before 2.3.0 allows authenticated users to read or reset othe
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today