CVE-2025-66508: 1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers

December 8, 2025 (updated December 17, 2025)

The server trusts all reverse-proxy headers by default, so any remote client can spoof X-Forwarded-For to bypass IP-based protections (AllowIPs, API IP whitelist, “localhost-only” checks). All IP-based access control becomes ineffective.

References

github.com/1Panel-dev/1Panel
github.com/1Panel-dev/1Panel/commit/94f7d78cc9768ee244da33e09408017d1f68b5ed
github.com/1Panel-dev/1Panel/security/advisories/GHSA-7cqv-qcq2-r765
github.com/advisories/GHSA-7cqv-qcq2-r765
nvd.nist.gov/vuln/detail/CVE-2025-66508

Code Behaviors & Features

Detect and mitigate CVE-2025-66508 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →