Unauthenticated SSRF in Openpanel Site Checker

Openpanel versions prior to 2.3.0 contain a critical server-side request forgery (SSRF) vulnerability identified as CVE-2026-85609. The flaw exists in the GET /tools/site-checker endpoint, located in apps/api/src/controllers/tools.controller.ts, which fails to validate user-supplied URL inputs. An unauthenticated attacker can exploit this endpoint by providing a malicious URL parameter to the fetchWithRedirects function.

This vulnerability allows attackers to perform unauthorized HTTP requests from the server context, enabling them to probe internal services, scan local network ports, and access cloud instance metadata services (such as AWS/GCP/Azure metadata endpoints). Furthermore, the application returns response details, including status codes, page sizes, and HTML metadata, which can be leveraged for network reconnaissance. The vulnerability also supports leaking internal IP address information to third-party endpoints via the getIPInfo function. Defenders should prioritize patching all Openpanel instances to version 2.3.0 or later to remediate this vector.

Impact

Successful exploitation allows unauthenticated remote attackers to gain unauthorized visibility into internal network infrastructure, potentially leading to information disclosure of sensitive internal configurations, cloud environment secrets, or local service status. This exposure could serve as a precursor to further exploitation of internal services that were not intended to be internet-facing.

Recommendation

Prioritize the following actions to secure vulnerable Openpanel installations:

• Immediately upgrade all Openpanel instances to version 2.3.0 or later to address CVE-2026-85609.
• Implement egress filtering on the server hosting Openpanel to restrict network requests to authorized external domains only, preventing access to internal network segments or cloud metadata services.
• Audit web server access logs for repeated requests to /tools/site-checker containing suspicious query parameters, such as internal IP addresses (169.254.169.254, 10.x.x.x, 172.16-31.x.x, 192.168.x.x) or common internal service ports.