1Panel Untrusted X-Forwarded-For Header Vulnerability Bypassing IP Access Controls

A vulnerability in 1Panel, a web-based Linux server management control panel, allows remote clients to spoof the X-Forwarded-For header and bypass IP-based access controls. This issue affects all versions of 1Panel through 2.0.14. The vulnerability arises because the server trusts all reverse-proxy headers by default, allowing clients to manipulate their perceived IP address. As a result, protections that rely on IP whitelists or localhost checks are rendered ineffective.

Impact

Exploitation of this vulnerability allows remote clients to bypass all IP-based access controls, including whitelists and localhost-only checks, by spoofing their IP address in the X-Forwarded-For header.

Remediation

Users can upgrade to 1Panel version 2.0.15 to address this vulnerability.