Vulnerability · Published Sep 4, 2026 · Assigned by VulnCheck

CVE-2026-85612OpenPanel before 2.3.0 SSRF via favicon and og endpoints

High 7.5

In plain English

A high-severity server-side request forgery in openpanel from Openpanel-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 64.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrary internal hosts and cloud metadata endpoints, with small responses returned verbatim enabling credential theft and internal service enumeration.

Affected products (as reported)

Vendor	Product	Versions
Openpanel-dev	openpanel	0 – before 2.3.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-2hff-m67f-2w2w) vendor-advisory
VulnCheck Advisory: OpenPanel before 2.3.0 SSRF via favicon and og endpoints third-party-advisory