Is CVE-2026-85609 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85609 being exploited in the wild.

How severe is CVE-2026-85609?

High severity, with a CVSS score of 7.5, published 4 September 2026.

Is there a fix for CVE-2026-85609?

A patch was published on 2026-09-04: Fixed in version 2.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85609 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-85609?

Check whether you run OpenPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85609: Openpanel site-checker unauthenticated SSRF

CVE-2026-85609 · Severity: high · CVSS 7.5 · Published 2026-09-04

Openpanel is a website analytics and monitoring platform. An unauthenticated attacker can exploit the site-checker endpoint to make arbitrary server-side HTTP requests to internal networks and cloud metadata services, potentially stealing sensitive credentials, discovering internal infrastructure, and scanning for open services. This vulnerability requires no authentication and can be exploited remotely over the network.

Technologies: OpenPanel. Vendors: OpenPanel.

Quick answers

Is CVE-2026-85609 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85609 being exploited in the wild.
How severe is CVE-2026-85609?: High severity, with a CVSS score of 7.5, published 4 September 2026.
Which products and versions are affected?: OpenPanel before 2.3.0.
Is there a fix for CVE-2026-85609?: A patch was published on 2026-09-04: Fixed in version 2.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85609 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-85609?: Check whether you run OpenPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF, CWE-918) in the GET /tools/site-checker endpoint of apps/api/src/controllers/tools.controller.ts. The endpoint accepts a user-supplied url query parameter and passes it directly to fetchWithRedirects() without any IP address validation or SSRF protections. The vulnerable code makes unguarded HTTP requests via fetch(), follows up to 10 redirects, and performs additional reconnaissance (TCP connection timing, SSL certificate probing, robots.txt and sitemap fetching). The endpoint is registered in the public API scope with no authentication required and weak rate limiting. An unauthenticated remote attacker can access cloud metadata endpoints (e.g., AWS/GCP/Azure instance metadata at 169.254.169.254), probe internal services, perform port scanning via timing analysis, and leak internal IP addresses both directly and to third-party services. The vulnerability is patched in version 2.3.0.

Affected products

Openpanel Openpanel before 2.3.0

Timeline

2026-08-20: disclosed
2026-09-04: patched: Fixed in version 2.3.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.