CVE-2024-27288Medium· 6.3▾ Sunlit

1Panel open source panel project has an unauthorized vulnerability.

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score35/ 100 · Low

impact 34.7 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Mar 6, 2024

Updated

Sep 10, 2026

CVSS

6.3

Vendor

1Panel-dev

Product

github.com/1Panel-dev/1Panel

CWE

—

Depth score

35 · Low

EPSS

0.47% · p40

Platforms

—

Source

OSV

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

EPSS history

Exploit-prediction probability, daily snapshots since Sep 12.

0.5% → 0.5%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 920 days

Mar 6, 2024Published
Disclosed via OSV
Sep 10, 2026Record revised
Last analysed / modified upstream
Sep 12, 2026EPSS first tracked
0.5%

1Panel-dev #osv #go

Affected

github.com/1Panel-dev/1Panel < 1.10.1-lts

Patched in

github.com/1Panel-dev/1Panel 1.10.1-lts

Full technical detail▾

Overview

Impact

The steps are as follows:

Access https://IP:PORT/ in the browser, which prompts the user to access with a secure entry point.
Use Burp to intercept:

When opening the browser and entering the URL (allowing the first intercepted packet through Burp), the following is displayed:

It is found that in this situation, we can access the console page (although no data is returned and no modification operations can be performed)."

Affected versions: <= 1.10.0-lts

Patches

The vulnerability has been fixed in v1.10.1-lts.

Workarounds

It is recommended to upgrade the version to 1.10.1-lts.

References

If you have any questions or comments about this advisory:

Open an issue in https://github.com/1Panel-dev/1Panel Email us at [email protected]

Affected packages

github.com/1Panel-dev/1Panel < 1.10.1-lts

Remediation

Upgrade to a patched release:

github.com/1Panel-dev/1Panel 1.10.1-lts

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#osv#go

← Back to feed

CVE-2024-27288Medium· 6.3▾ Sunlit

1Panel open source panel project has an unauthorized vulnerability.

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score35/ 100 · Low

impact 34.7 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Mar 6, 2024

Updated

Sep 10, 2026

CVSS

6.3

Vendor

1Panel-dev

Product

github.com/1Panel-dev/1Panel

CWE

—

Depth score

35 · Low

EPSS

0.47% · p40

Platforms

—

Source

OSV

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

EPSS history

Exploit-prediction probability, daily snapshots since Sep 12.

0.5% → 0.5%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 920 days

Mar 6, 2024Published
Disclosed via OSV
Sep 10, 2026Record revised
Last analysed / modified upstream
Sep 12, 2026EPSS first tracked
0.5%

1Panel-dev #osv #go

Affected

github.com/1Panel-dev/1Panel < 1.10.1-lts

Patched in

github.com/1Panel-dev/1Panel 1.10.1-lts

Full technical detail▾

Overview

Impact

The steps are as follows:

Access https://IP:PORT/ in the browser, which prompts the user to access with a secure entry point.
Use Burp to intercept:

When opening the browser and entering the URL (allowing the first intercepted packet through Burp), the following is displayed:

It is found that in this situation, we can access the console page (although no data is returned and no modification operations can be performed)."

Affected versions: <= 1.10.0-lts

Patches

The vulnerability has been fixed in v1.10.1-lts.

Workarounds

It is recommended to upgrade the version to 1.10.1-lts.

References

If you have any questions or comments about this advisory:

Open an issue in https://github.com/1Panel-dev/1Panel Email us at [email protected]

Affected packages

github.com/1Panel-dev/1Panel < 1.10.1-lts

Remediation

Upgrade to a patched release:

github.com/1Panel-dev/1Panel 1.10.1-lts

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#osv#go