Is CVE-2026-85614 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-85614?

CVE-2026-85614 has a CVSS v3 severity of HIGH (8.6).

Back

CVE-2026-85614

Description

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue requests to internal services, localhost, and cloud metadata endpoints, reading internal HTTP response titles, headers, status codes, and SSL certificate information.