External risk intelligence

OpenPanel Unauthenticated Server-Side Request Forgery in Site Checker

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-85614

OpenPanel is a server management control panel designed to be internet-facing to allow administrators to manage web hosting environments remotely. The vulnerable endpoint is part of the public web interface, making it commonly reachable from the internet in standard deployments.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in OpenPanel, a technology used for managing web hosting environments. This issue allows unauthorized access to internal network resources and cloud metadata by tricking the OpenPanel server into making requests to them.

Enables unauthorized access to internal systems.
Critical for maintaining secure infrastructure operations.
Confirm relevance and exposure within our environment.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable component through the internet by sending a request to the `GET /tools/site-checker` endpoint. This endpoint, which lacks proper validation, allows the attacker to control a URL parameter. By manipulating this parameter, the attacker can trick the server into making requests to internal systems or cloud metadata endpoints. This can expose sensitive information from the server's responses, such as titles, headers, status codes, and SSL certificate details.

No authentication needed to access.
Attacker controls URL parameter in request.
Can read internal network information.

Live Threat

Current exploitation, exposure, and threat context

The OpenPanel server, when vulnerable, could be tricked into making requests to internal systems or cloud metadata endpoints. This could expose details like HTTP response titles, headers, status codes, and SSL certificate information from those internal or cloud resources.

Internal service information.
Server issues requests to unintended destinations.
Exposure of internal network or cloud metadata.

Operational Fix

Recommended remediation, mitigation, and detection steps

The OpenPanel server management tool's `site-checker` endpoint is susceptible to SSRF, potentially allowing attackers to probe internal services. Infrastructure or platform teams managing OpenPanel deployments should lead the response, coordinating with security and network teams to identify exposed instances, assess business criticality, and determine the scope of potential internal reconnaissance. The immediate first step is to locate all OpenPanel instances, verify their network exposure, and confirm their accountability for remediation.

Identify vulnerable OpenPanel instances.
Verify internal network reachability and criticality.
Plan remediation with vendor and stakeholders.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenPanel?

OpenPanel is an open-source control panel designed to simplify the management of web hosting environments. It provides administrators with a centralized web interface to oversee servers, websites, and infrastructure configurations remotely. Because it is intended to manage live web hosting services, these panels are frequently configured to be accessible over the internet, allowing for convenient off-site server administration.

What does CVE-2026-85614 mean for security?

This vulnerability is classified as Server-Side Request Forgery, or SSRF (CWE-918). It occurs when an application fails to properly validate a user-supplied URL. In this case, an attacker can manipulate a specific parameter in the site-checker tool to force the OpenPanel server to act as a proxy, sending requests to internal addresses that would otherwise be blocked from the public internet.

How is this SSRF vulnerability triggered?

An attacker triggers the flaw by sending a crafted request to the site-checker endpoint without needing to log in. By inserting an internal or local URL into the request parameter, the attacker can force the server to fetch data from its own internal network. Importantly, this does not require any existing privileges or user credentials; simply reaching the publicly accessible endpoint is sufficient to initiate the unauthorized server-side request.

Is my instance affected by this vulnerability?

If you run an instance of OpenPanel, you should consider it potentially reachable by attackers. According to Halo Surface Signal, this software is typically deployed in internet-facing configurations to facilitate remote management. Because the vulnerable endpoint is part of the standard public web interface, any instance connected to the internet is likely accessible to external actors, making it critical to confirm your current version.

What is the first step to address CVE-2026-85614?

Begin by auditing your environment to identify all active OpenPanel instances. Once located, verify their network exposure—specifically whether the interface is accessible from the internet. Consult official vendor documentation to confirm if your deployment is running a version earlier than 2.3.0. Coordinating with your infrastructure and network teams to limit access to the administrative dashboard can serve as an immediate defensive measure while planning for an update.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.