{"data":{"id":"a82d11f2-91f0-4f3d-9168-16be53a835e6","title":"CVE-2025-54424: 1Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux…","summary":"1Panel, a web interface and MCP Server for managing websites, files, containers, databases and LLMs on Linux servers, is affected through versions 2.0.5 and below. Its HTTPS communication between the Core and Agent endpoints does not fully verify certificates, which allows unauthorized access to interfaces. Because 1Panel exposes many command execution and high-privilege interfaces, this leads to Remote Code Execution.","solution":"Fixed in version 2.0.6.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-54424","publishedAt":"2025-08-01T23:15:24.947Z","cveId":"CVE-2025-54424","cweIds":["CWE-77"],"cvssScore":"8.1","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/1Panel-dev/1Panel/core@>= 1.0.0, < 2.0.6 (fixed: 2.0.6)","github.com/1Panel-dev/1Panel/core@< 0.0.0-20250730021757-04b9cbd87a15 (fixed: 0.0.0-20250730021757-04b9cbd87a15)"],"affectedPackageNames":["github.com/1panel-dev/1panel/core"],"affectedPackageRefs":["go:github.com/1panel-dev/1panel/core"],"affectedVendors":[],"affectedVendorsRaw":["1Panel","GitHub Copilot"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"1Panel remote code execution via incomplete certificate verification","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0109,"epssCheckedAt":"2026-11-04T12:08:35.127Z","kevDateAdded":null,"advisoryAliases":["GHSA-8j63-96wh-wh3j"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:53:12.308Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-10-29T21:44:04.730Z","capecIds":["CAPEC-88"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.6,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"github.com/1Panel-dev/1Panel/core","fixedVersion":"2.0.6","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":null,"status":"package_not_found","checkedAt":"2026-10-29T21:44:04.580Z"},{"ecosystem":"go","name":"github.com/1Panel-dev/1Panel/core","fixedVersion":"0.0.0-20250730021757-04b9cbd87a15","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":null,"status":"package_not_found","checkedAt":"2026-10-29T21:44:04.580Z"}]}}