1Panel set-cookie is missing the Secure keyword
Priority HIGH 66CWE-315Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-311.
Summary
1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue has been patched in version 1.9.6.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00304 23rd percentileScored 2026-11-07
Fix Fixed github.com/1Panel-dev/1Panel (Go): 1.9.6
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| 1Panel-dev | 1Panel | up to 1.9.5 | — | No fix listed | CNA |
| — | github.com/1Panel-dev/1Panel (Go) | before 1.9.6 | 1.9.6 | Patch available | GHSA-9xfw-jjq2-7v8h |
- 1Panel Vendor1Panel-dev Affected up to 1.9.5 Fixed in — No fix listed CNA
- github.com/1Panel-dev/1Panel (Go) Vendor— Affected before 1.9.6 Fixed in 1.9.6 Patch available GHSA-9xfw-jjq2-7v8h
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fit2cloud:1panel:1.9.5:*:*:*:*:*:*:* | 1.9.5 | Vulnerable | 1Panel-dev |
- cpe:2.3:a:fit2cloud:1panel:1.9.5:*:*:*:*:*:*:* Versions 1.9.5 Vulnerable ·1Panel-dev
Remediation
- Fix · GHSA-9xfw-jjq2-7v8h github.com/1Panel-dev/1Panel (Go) Fixed in 1.9.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-24768
- 2026-10-03 Alias added: GHSA-9xfw-jjq2-7v8h
References
Patch 2
Advisory 2
More 1Panel-dev 1panel vulnerabilities
- TI-2024-26801 a sqlinjection in 1Panel CVSS 3.1CRITICAL 9.8
- TI-2023-20859 1Panel arbitrary file write vulnerability exists in the background CVSS 3.1CRITICAL 9.8
- TI-2025-34229 1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution CVSS 3.1CRITICAL 9.8
- TI-2024-02187 1Panel swap baseApi.UpdateDeviceSwap command injection CVSS 3.1CRITICAL 9.8
- TI-2025-35333 OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing… CVSS 3.1HIGH 8.8
- TI-2023-19085 Command injection in firewall ip functionality in 1Panel CVSS 3.1HIGH 8.8
Sources
- CVE-2024-24768 · CVE Program
- CVE-2024-24768 · NVD
- FIRST EPSS
- GHSA-9xfw-jjq2-7v8h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences