OpenPanel API before 2.3.0 contains an unauthenticated server‑side request forgery vulnerability in the GET /tools/site-checker endpoint. The endpoint accepts a fully client‑controlled URL parameter without filtering or DNS‑rebinding protection, allowing an attacker to instruct the OpenPanel server to make HTTP requests to arbitrary destinations. The response titles, headers, status codes, and SSL certificate information from those requests are returned in the API response, enabling an attacker to discover internal service URLs, internal IP addresses, and cloud metadata endpoints.

OpenPanel, developed by Openpanel‑dev, is affected. Versions before 2.3.0 contain this SSRF flaw. Any OpenPanel installation running a release older than 2.3.0 is vulnerable.

The flaw poses a critical confidentiality risk, as noted by the CVSS score of 9.2. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote unauthenticated HTTP request to the site‑checker endpoint with a malicious URL, after which the OpenPanel server initiates outbound traffic to internal or cloud services. This allows attackers to probe internal infrastructure, extract sensitive metadata, and potentially gain footholds into other services if additional vulnerabilities exist. The vulnerability does not directly provide denial of service or privilege escalation, but the exposed internal information can facilitate future attacks.