EUVD-2026-71028
GHSA-m7f4-qmh8-fvrx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-exposed Openpanel API
-
DeliveryCraft GET /tools/site-checker?url= with IMDS or internal target
-
ExploitServer invokes fetchWithRedirects() with attacker-supplied URL
-
ExecutionResponse content, headers, and metadata returned to attacker
-
PersistHarvest IAM credentials or internal service data
-
ImpactPivot to cloud account or internal network
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication is required - the CVSS 4.0 vector confirms PR:N and UI:N, and the endpoint is unauthenticated with no session or token check. The only prerequisite is network reachability to the Openpanel API port. Cloud-hosted deployments (AWS, GCP, Azure) face the highest impact because the application server's network namespace can reach link-local IMDS addresses (169.254.169.254); on-premises deployments without cloud metadata services remain vulnerable to internal network probing, port scanning, and internal service data retrieval. No Openpanel feature flag, non-default configuration, or administrative setup is required - the /tools/site-checker endpoint is present and exposed in all pre-2.3.0 deployments by default. |
| Impact | The vendor-provided CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L) correctly identifies the barrier-free network attack surface but conservatively scores subsequent-system confidentiality at SC:L. In cloud-deployed environments, IMDS access can yield IAM role credentials or service account tokens with broad permissions, making the practical confidentiality impact materially higher than SC:L suggests - this discrepancy should be evaluated per deployment context. No EPSS score was provided in the available data, so exploitation probability cannot be quantified. No CISA KEV listing exists, indicating no confirmed active exploitation at time of analysis. The attack requires zero authentication, no user interaction, and no special configuration, making it trivially automatable and scannable at scale - a meaningful real-world risk amplifier for any internet-exposed Openpanel instance. The third-party IP-leakage via getIPInfo() introduces a compliance dimension independent of the primary SSRF, as internal network topology data is transmitted to an external service whose identity is not disclosed in the advisory. |
| Exploit ScenarioDerived | An unauthenticated attacker sends GET /tools/site-checker?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/ to an internet-exposed Openpanel API instance. The server-side fetchWithRedirects() call retrieves IAM role credentials from the AWS instance metadata service and the endpoint returns the response content, status code, and parsed metadata directly to the attacker. With recovered temporary credentials the attacker pivots to the underlying cloud account, escalating far beyond the initial Openpanel application boundary. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
Unauthenticated full-read SSRF in Openpanel before 2.3.0 enables remote attackers to issue arbitrary server-side HTTP requests through the /tools/site-checker endpoint, with no authentication, IP allowlisting, or SSRF mitigation in place. The endpoint's url query parameter is passed directly to fetchWithRedirects() in apps/api/src/controllers/tools.controller.ts, allowing attackers to reach cloud instance metadata services (e.g., AWS IMDS at 169.254.169.254), enumerate internal ports, and retrieve response content including status codes, page sizes, and parsed HTML metadata. A secondary leakage path via getIPInfo() exfiltrates internal IP addresses to a third-party service, exposing network topology data beyond the attacker's direct channel. No public exploit code has been identified at time of analysis.
RemediationAI
Upgrade Openpanel to version 2.3.0 or later, which resolves the SSRF by introducing URL and IP validation in the site-checker endpoint; the fix is confirmed in the vendor GitHub security advisory at https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-r3jv-rmrg-j395. If immediate upgrade is not feasible, block external access to the /tools/site-checker API path at the reverse-proxy or WAF layer - note this disables the site-checker feature entirely. Additionally, configure egress firewall rules on the application host to block outbound requests to RFC-1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and link-local space (169.254.0.0/16) to prevent IMDS and internal service access; this does not address the getIPInfo() third-party IP leakage path, which requires patching to remediate. Monitor application egress logs for anomalous outbound HTTP requests originating from the Openpanel API process as a detection measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Openpanel is an open-source product analytics platform developed by openpanel-dev (github.com/Openpanel-dev/openpanel). The vulnerable component is the GET /tools/site-checker API endpoint implemented in apps/api/src/controllers/tools.controller.ts, which exposes a url query parameter that is passed unsanitized into fetchWithRedirects() - a server-side HTTP fetch function. CWE-918 (Server-Side Request Forgery) precisely describes the root cause: user-controlled network destinations reach a server-side fetch function without blocklisting RFC-1918 and link-local address spaces, enforcing allowlists, or validating resolved IPs after DNS resolution. The affected CPE is cpe:2.3:a:openpanel-dev:openpanel:*:*:*:*:*:*:*:*, covering all versions before 2.3.0. Cloud-hosted deployments face elevated risk because the application server can reach link-local IMDS endpoints (169.254.169.254 for AWS and GCP) that may return IAM credentials, access tokens, or bootstrap secrets, amplifying the effective confidentiality impact beyond what the CVSS 4.0 SC:L metric reflects.
Know when Openpanel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
Scope changes because the server reaches internal systems beyond itself; C:L and I:L reflect internal data disclosure and third-party IP leakage with no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint (apps/api/src/controllers/tools.controller.ts). The endpoint passes a user-supplied url query parameter to fetchWithRedirects() and performs server-side HTTP requests to arbitrary URLs without any SSRF/IP validation. An unauthenticated remote attacker can access cloud instance metadata endpoints, probe internal services, scan internal network ports, and read returned content (status code, page size, timing, and parsed HTML metadata), and leak internal IP addresses (via getIPInfo() to a third party).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Code execution in OpenPanel's js-runtime component lets an authenticated user who holds project write access escape the
An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function. Rated h
An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function. Rated m
Cross Site Request Forgery vulnerability in Open Panel OpenAdmin v.0.3.4 allows a remote attacker to escalate privileges
Server-side request forgery in OpenPanel before 2.3.0 lets unauthenticated remote attackers coerce the panel server into
Unauthenticated ClickHouse SQL injection in OpenPanel before 3.0.0 lets remote attackers read other tenants' analytics d
Sandbox escape in OpenPanel's JavaScript webhook-template runtime (packages/js-runtime) allows an authenticated project
Authenticated remote code execution in OpenPanel before 2.3.0 allows any project member with read access to escape the m
Unauthenticated information disclosure in OpenPanel (openpanel-dev/openpanel) exposes argon2id password hashes and full
Unauthenticated SSRF in OpenPanel before 2.3.0 exposes two utility endpoints - /misc/favicon and /misc/og - that blindly
Cross-tenant data exposure in OpenPanel before 3.0.0 lets any authenticated user read other projects' profiles, events a
Read-level project members in OpenPanel before 3.0.0 can retrieve plaintext integration secrets - Slack bot tokens, inco
Exploit-DB