OpenPanel EUVD-2026-71033

No special conditions - remote unauthenticated exploitation against default configurations of OpenPanel before 2.3.0 via the GET /tools/site-checker endpoint (AV:N/AC:L/PR:N/UI:N). The only prerequisite is network reachability to the OpenPanel web interface. Impact severity is amplified when the host runs in a cloud environment exposing a metadata endpoint (particularly IMDSv1) or sits adjacent to unauthenticated internal services; it is limited to a read primitive returning response titles, headers, status codes, and SSL certificate information - the attacker cannot directly write or execute, and blind SSRF constraints apply where responses are not reflected.

The CVSS 4.0 score of 9.2 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) reflects a genuinely low-friction, unauthenticated, network-reachable read primitive with high confidentiality impact on both the vulnerable system and downstream subsequent systems (SC:H) - consistent with the described ability to pivot into internal services and cloud metadata. No EPSS score, KEV listing, or public PoC was provided, so exploitation is inferred rather than confirmed; the absence of KEV suggests it is not yet known to be actively exploited, but the trivial attack conditions and blind-to-partial-read exfiltration make it an attractive target where the panel is internet-exposed. The real-world severity hinges on deployment context: an OpenPanel instance running in a cloud environment with an exploitable metadata endpoint (especially IMDSv1) faces credential theft and lateral movement, whereas an on-prem box with segmented internals is more limited to internal reconnaissance. Any operator running an internet-facing OpenPanel below 2.3.0 should treat patching as urgent given the unauthenticated, low-complexity nature of the flaw.

An attacker locates an internet-facing OpenPanel below 2.3.0 and sends an unauthenticated GET /tools/site-checker request with url pointing at http://169.254.169.254/latest/meta-data/ or an internal admin service. The server fetches the target and reflects back titles, headers, status codes, and certificate data, letting the attacker map internal infrastructure and potentially read cloud instance metadata. No public PoC is required given the low complexity, though none is confirmed available at time of analysis.