CVE-2026-108702 1Panel-dev CVE debrief

Who should care

Defenders responsible for 1Panel-dev CordysCRM systems, especially those using version 1.9.3 or earlier, should assess exposure to potential SSRF attacks and prioritize verification and mitigation efforts.

Why it matters

CVE-2026-108702 is a medium-severity vulnerability in 1Panel-dev CordysCRM that allows authenticated users to trigger server-side requests to attacker-supplied URLs, potentially leading to SSRF attacks and exposure of internal addresses. Defenders should verify the presence of this vulnerability, assess exposure, and prioritize mitigation efforts.

• Potential exposure of internal addresses to SSRF attacks.
• Possible unauthorized probing of internal systems.
• Risk of bypassing SSRFValidator through redirecting GET requests.
• Need for verification of affected versions and remediation status.

Technical summary

The vulnerability exists in 1Panel-dev CordysCRM through version 1.9.3. An authenticated user can trigger server-side requests to attacker-supplied URLs via the POST /approval-flow/webhook/test endpoint without a PROCESS_SETTING permission check. This allows for potential SSRF attacks, enabling attackers to probe internal addresses by analyzing success or failure results of GET requests. Defenders should prioritize verifying the presence of this vulnerability in their systems, especially if they are using 1Panel-dev CordysCRM version 1.9.3 or earlier, and assess the exposure of internal addresses to potential SSRF attacks.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their systems, especially if they are using 1Panel-dev CordysCRM version 1.9.3 or earlier, and assess the exposure of internal addresses.

Recommended defensive actions

• Verify the presence of this vulnerability in 1Panel-dev CordysCRM systems, especially version 1.9.3 or earlier.
• Assess the exposure of internal addresses to potential SSRF attacks.
• Implement necessary patches or compensating controls to mitigate the vulnerability.
• Monitor for suspicious server-side requests to prevent potential exploitation.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The evidence provided includes details from the CVE Program record, NVD vulnerability detail, and source references from GitHub and Vulncheck. However, the corpus does not establish versions beyond 1.9.3, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.