CVE-2025-34430: 1Panel CSRF — MEDIUM

CISO Take

1Panel, an open-source Linux/Docker server management panel, ships an endpoint that lets an authenticated admin change the panel's display name — but it does so with zero CSRF protection, meaning no anti-CSRF token and no Origin/Referer check. Any attacker who lures a logged-in 1Panel admin to a malicious webpage can silently force that admin's browser to submit the rename request, since the session cookie travels automatically. The practical blast radius is small: EPSS sits at just 0.18%, there's no CISA KEV listing, no public exploit or scanner template, and the affected field is cosmetic rather than data or execution — this is not an AI/ML-specific attack surface, it just happens to be infrastructure some teams use to self-host AI apps (Ollama, Open WebUI, and similar are common items in 1Panel's app store). Treat this as routine hygiene rather than an incident: upgrade past 2.0.15 when a fix lands, and in the meantime restrict panel access to VPN/allowlisted IPs and avoid browsing untrusted links while authenticated to the admin session. Monitor for unexpected panel-name changes as a low-cost tripwire for broader CSRF probing against the same host.

Sources: NVD EPSS 1panel.pro GitHub Advisory vulncheck.com

What is the risk?

Low real-world risk. The vulnerability is a textbook CSRF (CWE-352) with no session hijacking, no privilege escalation, and no data exfiltration — the only consequence is an unauthorized cosmetic change to the panel's display name. EPSS is extremely low (0.18%), it is not in CISA KEV, no public exploit code or Nuclei template exists, and CVSS data was not published, consistent with a medium-severity classification. The main risk vector is that it demonstrates the endpoint's broader lack of CSRF defenses, which raises the question of whether other mutating admin endpoints in the same panel share the same gap — that's worth checking even though this specific CVE is low-stakes.

How does the attack unfold?

Delivery

Attacker crafts a webpage with a hidden auto-submitting form targeting the panel-name-change endpoint and lures the admin to visit it.

Trigger

Victim's browser, still authenticated to 1Panel, automatically submits the forged request with valid session cookies since no CSRF token or Origin check is enforced.

Impact

The panel's display name is changed to an attacker-chosen value without the admin's consent, which could be used for defacement or as a pretext for follow-on social engineering.

Delivery

Attacker crafts a webpage with a hidden auto-submitting form targeting the panel-name-change endpoint and lures the admin to visit it.

Trigger

Victim's browser, still authenticated to 1Panel, automatically submits the forged request with valid session cookies since no CSRF token or Origin check is enforced.

Impact

The panel's display name is changed to an attacker-chosen value without the admin's consent, which could be used for defacement or as a pretext for follow-on social engineering.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
1Panel	—	—	No patch

Do you use 1Panel? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.2%

chance of exploitation in 30 days

Higher than 10% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

Upgrade 1Panel to a version beyond 2.0.15 once the vendor ships a fix that adds CSRF tokens or Origin/Referer validation on the panel-name endpoint (track https://github.com/1Panel-dev/1Panel/releases). Until patched, restrict access to the 1Panel admin UI to a VPN or IP allowlist so the authenticated session is never reachable from a browser that might also visit attacker-controlled pages. Advise admins not to click unknown links while logged into the panel, and consider a browser profile dedicated to admin tooling. As a detection measure, alert on unexpected changes to the panel name/config outside of maintenance windows.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Social Engineering API

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2025-34430?

1Panel, an open-source Linux/Docker server management panel, ships an endpoint that lets an authenticated admin change the panel's display name — but it does so with zero CSRF protection, meaning no anti-CSRF token and no Origin/Referer check. Any attacker who lures a logged-in 1Panel admin to a malicious webpage can silently force that admin's browser to submit the rename request, since the session cookie travels automatically. The practical blast radius is small: EPSS sits at just 0.18%, there's no CISA KEV listing, no public exploit or scanner template, and the affected field is cosmetic rather than data or execution — this is not an AI/ML-specific attack surface, it just happens to be infrastructure some teams use to self-host AI apps (Ollama, Open WebUI, and similar are common items in 1Panel's app store). Treat this as routine hygiene rather than an incident: upgrade past 2.0.15 when a fix lands, and in the meantime restrict panel access to VPN/allowlisted IPs and avoid browsing untrusted links while authenticated to the admin session. Monitor for unexpected panel-name changes as a low-cost tripwire for broader CSRF probing against the same host.

Is CVE-2025-34430 actively exploited?

No confirmed active exploitation of CVE-2025-34430 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-34430?

Upgrade 1Panel to a version beyond 2.0.15 once the vendor ships a fix that adds CSRF tokens or Origin/Referer validation on the panel-name endpoint (track https://github.com/1Panel-dev/1Panel/releases). Until patched, restrict access to the 1Panel admin UI to a VPN or IP allowlist so the authenticated session is never reachable from a browser that might also visit attacker-controlled pages. Advise admins not to click unknown links while logged into the panel, and consider a browser profile dedicated to admin tooling. As a detection measure, alert on unexpected changes to the panel name/config outside of maintenance windows.

What is the CVSS score for CVE-2025-34430?

No CVSS score has been assigned yet.

What are the technical details?

Original Advisory

1Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the panel name management functionality. The affected endpoint does not implement CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a panel-name change request; if a victim visits the page while authenticated, the browser includes valid session cookies and the request succeeds. This allows a remote attacker to change the victim’s panel name to an arbitrary value without consent.

Exploitation Scenario

An attacker sends a 1Panel administrator a link to an innocuous-looking page (e.g., via email, chat, or a compromised site) that contains a hidden auto-submitting HTML form targeting the panel-name-change endpoint. If the admin is currently authenticated to their 1Panel instance in the same browser, the browser attaches valid session cookies to the forged request and the panel name changes without the admin's knowledge or consent. While the direct impact is cosmetic, an attacker could use this as a low-noise probe to confirm the CSRF gap exists, or pair the rename with social-engineering (e.g., renaming the panel to a fake 'compromised — contact support' message) to manipulate staff into taking further unsafe actions.

Weaknesses (CWE)

CWE-352 Cross-Site Request Forgery (CSRF)

CWE-352 — Cross-Site Request Forgery (CSRF): The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330] Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]
[Implementation] Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

Source: MITRE CWE corpus.