The flaw is an unauthenticated server‑side request forgery in the /misc/favicon and /misc/og endpoints of OpenPanel. An attacker supplies a malicious URL that the application blindly fetches and returns a fragment of the response. This allows the external party to force the server to reach arbitrary internal resources, including cloud metadata endpoints, and obtain data such as instance tokens or internal host names. The weakness is a lack of input validation, classified as CWE‑918.

All OpenPanel releases prior to version 2.3.0 distributed by Openpanel‑dev are affected. Any deployment running OpenPanel 2.2.x or earlier, whether in on‑premise or cloud environments, is vulnerable.

The CVSS score of 8.7 indicates high severity, reflecting the potential impact on confidentiality of internal services. Because the vulnerability is unauthenticated and accepts any arbitrary URL, it is straightforward for an attacker to exploit it remotely by sending a simple HTTP request to the exposed endpoints. No authentication or additional privileges are required. The problem is not yet listed in the CISA KEV catalog.