Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/1Panel-dev/1Panel/core < 0.0.0-20251128030527-ac43f00273be
Fixed in
0.0.0-20251128030527-ac43f00273be· Vendor fix available
Issue
A CAPTCHA bypass vulnerability in the 1Panel authentication API allows an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections could be bypassed, enabling automated login attempts and significantly increasing the risk of account takeover (ATO). Details The /api/login endpoint accepts a boolean field named ignoreCaptcha directly from the client request body: "ignoreCaptcha": true The backend implementation uses this value to determine whether CAPTCHA validation should be performed: Because req.IgnoreCaptcha is taken directly from user input—with no server-side validation, no session binding, and no privilege checks—any unauthenticated attacker can force CAPTCHA validation to be skipped. There are no additional conditions, such as: no requirement for MFA no trusted device no IP reputation checks no prior valid session no rate limiting…
Recommended action: Upgrade to 0.0.0-20251128030527-ac43f00273be (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/1Panel-dev/1Panel/core >= 1.0.0, < 2.0.6; < 0.0.0-20250730021757-04b9cbd87a15
Fixed in
0.0.0-20250730021757-04b9cbd87a152.0.6· Vendor fix available
Issue
Project Address: Project Address 1Panel Official website: https://www.1panel.cn/ Time: 2025 07 26 Version: 1panel V2.0.5 Vulnerability Summary - First, we introduce the concepts of 1panel v2 Core and Agent. After the new version is released, 1panel adds the node management function, which allows you to control other hosts by adding nodes. - The HTTPS protocol used for communication between the Core and Agent sides did not fully verify the authenticity of the certificate during certificate verification, resulting in unauthorized interfaces. The presence of a large number of command execution or high-privilege interfaces in the 1panel led to RCE. Code audit process 1. First we go to the Agent HTTP routing fileagent/init/router/router.go 2. It was found that the Routersreference function in the function Certificatewas globally checked.agent/middleware/certificate.go 3. The discovery Certificatefunction determines c.Request.TLS.HandshakeCompletewhether certificate communication has been…
Recommended action: Upgrade to 2.0.6 or 0.0.0-20250730021757-04b9cbd87a15 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.