CVE-2025-66508
December 09, 2025
1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin's default configuration which trusts all IP addresses as proxies (TrustedProxies = 0.0.0.0/0), allowing any client to spoof the X-Forwarded-For header. Since all IP-based access controls (AllowIPs, API whitelists, localhost-only checks) rely on ClientIP(), attackers can bypass these protections by simply sending X-Forwarded-For: 127.0.0.1 or any whitelisted IP. This renders all IP-based security controls ineffective. This issue is fixed in version 2.0.14.
Affected Packages
github.com/1Panel-dev/1Panel (GO):
Affected version(s) >=v0.0.0-20250612144841-daef59b56888 <v2.0.14Fix Suggestion:
Update to version v2.0.14github.com/1Panel-dev/1Panel/agent (GO):
Affected version(s) >=v0.0.0-20250627102324-4ef9fcde59a7 <v0.0.0-20251201063338-94f7d78cc976Fix Suggestion:
Update to version v0.0.0-20251201063338-94f7d78cc976https://github.com/1Panel-dev/1Panel.git (SCM_GIT):
Affected version(s) >=v1.0.0 <v2.0.14Fix Suggestion:
Update to version v2.0.14Related Resources (4)
Do you need more information?
Contact UsCVSS v4
Base Score:
6.9
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Authentication Bypass by Spoofing
EPSS
Base Score:
0.04
