CVE-2025-66508 json
1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers
published 2025-12-08 11 mo ago modified 2026-10-14 25 d ago also EUVD-2025-201792 , GHSA-7cqv-qcq2-r765 , GO-2025-4207
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 16%
- public exploits
- 0
- none known
Summary
1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin's default configuration which trusts all IP addresses as proxies (TrustedProxies = 0.0.0.0/0), allowing any client to spoof the X-Forwarded-For header. Since all IP-based access controls (AllowIPs, API whitelists, localhost-only checks) rely on ClientIP(), attackers can bypass these protections by simply sending X-Forwarded-For: 127.0.0.1 or any whitelisted IP. This renders all IP-based security controls ineffective. This issue is fixed in version 2.0.14.
Patch / fix
- go github.com/1Panel-dev/1Panel 2.0.14, 2.0.14+incompatible
- go github.com/1Panel-dev/1Panel/agent 0.0.0-20251201063338-94f7d78cc976
- fit2cloud 1panel 2.0.14
- govulncheck-vulndb openSUSE Leap 15.6 0.0.20251230T014957-150000.1.134.1
suse advisories SUSE-SU-2026:0037-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 11 mo ago
Exploit prediction
0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/1Panel-dev/1Panel | <2.0.14 <2.0.14+incompatible |
2.0.14 2.0.14+incompatible |
| go | github.com/1Panel-dev/1Panel/agent | <0.0.0-20251201063338-94f7d78cc976 |
0.0.0-20251201063338-94f7d78cc976 |
Affected products
- 1Panel-dev 1Panel
Classification
- Weakness
-
- CWE-290 Authentication Bypass by Spoofing
References
-
github.com
/1Panel-dev/1Panel/commit/94f7d78cc9768ee244da33e09408017d1f68b5ed
web, patch
-
github.com
/1Panel-dev/1Panel/security/advisories/GHSA-7cqv-qcq2-r765
web, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-66508
advisory
-
github.com
/1Panel-dev/1Panel
package
Sources
- CVE List CVE-2025-66508
- GitHub Advisory GHSA-7cqv-qcq2-r765
- NVD CVE-2025-66508
- OSV GO-2025-4207
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.