CVE-2025-54424 is a high severity (CVSS 8.1) flaw in 1Panel, the web based Linux server manager. Incomplete certificate verification between its Core and Agent endpoints allows unauthorised interface access, which leads to remote code execution. Versions 2.0.5 and below are affected; 2.0.6 fixes it.
What's affected
- 1Panel 2.0.5 and below.
- Fixed in 1Panel 2.0.6.
The record lists CVSS 8.1 (High). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Check the version shown in the 1Panel interface or on the release tag your installer used. Anything at 2.0.5 or below needs the update.
Also check whether the panel's port is reachable from the internet or from untrusted networks.
What to do now
- Upgrade 1Panel to 2.0.6 or later.
- Restrict panel access to a VPN or an allow list of addresses.
- Review the panel's accounts, scheduled tasks and containers for changes you did not make.
- Rotate credentials stored in the panel if you suspect misuse.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The record tags the weakness as CWE-77. The root cause it describes is incomplete certificate checking on the HTTPS link between Core and Agent. Because 1Panel has many interfaces that run commands or use high privileges, unauthorised access to them becomes code execution.
A server management panel is a high value target: it holds the keys to websites, databases and containers. TLS only protects a connection when both ends check who they are talking to.
Severity scores are a starting point. The score for this entry is 8.1, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
Is this a command injection bug?
The record tags it as CWE-77, but the described cause is incomplete certificate verification that exposes command running interfaces.
What is fixed in 2.0.6?
The advisory says 2.0.6 fixes the certificate validation. Read the release notes for details.
Sources
- https://github.com/1Panel-dev/1Panel/pull/9698/commits/4003284521f8d31ddaf7215d1c30ab8b4cdb0261
- https://github.com/1Panel-dev/1Panel/releases/tag/v2.0.6
- https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-8j63-96wh-wh3j
Last reviewed: 18 October 2026.
