CVE-2025-66508 1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers

Medium 6.5 Published 9 Dec 2025 Updated 9 Dec 2025

Attackers can bypass IP-based access controls in 1Panel by spoofing the X-Forwarded-For header due to insecure proxy trust settings.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-66508?

CVE-2025-66508 is a medium-severity authentication bypass vulnerability in 1Panel-dev 1Panel, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin's default configuration which trusts all IP addresses as proxies (TrustedProxies = 0.0.0.0/0), allowing any client to spoof the X-Forwarded-For header. Since all IP-based access controls (AllowIPs, API whitelists, localhost-only checks) rely on ClientIP(), attackers can bypass these protections by simply sending X-Forwarded-For: 127.0.0.1 or any whitelisted IP. This renders all IP-based security controls ineffective. This issue is fixed in version 2.0.14.

Weakness: CWE-290

Which versions are affected by CVE-2025-66508?

6 open source packages ship an affected version, including github.com/1Panel-dev/1Panel and github.com/1Panel-dev/1Panel/agent. It affects 1 product.

Package	Affected	Fixed in
`github.com/1Panel-dev/1Panel` Go	All versions	`2.0.14`
`github.com/1Panel-dev/1Panel` Go	All versions	`2.0.14`
`github.com/1Panel-dev/1Panel` Go	All versions	`2.0.14+incompatible`
`github.com/1Panel-dev/1Panel/agent` Go	All versions	`0.0.0-20251201063338-94f7d78cc976`
`github.com/1Panel-dev/1Panel/agent` Go	All versions	`0.0.0-20251201063338-94f7d78cc976`
`github.com/1Panel-dev/1Panel/agent` Go	All versions	`0.0.0-20251201063338-94f7d78cc976`

Products include Fit2cloud 1panel.

How do I fix CVE-2025-66508?

Upgrade github.com/1Panel-dev/1Panel to a fixed version for your release line: 2.0.14 or 2.0.14+incompatible.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2025-66508 being exploited?

There is no known exploitation of CVE-2025-66508 in the wild and no public exploit code.

Sources

Also known as GHSA-7cqv-qcq2-r765, GO-2025-4207.