donknap dpanel up to 1.6.0 hard-coded key

Summaryinfo

A vulnerability described as critical has been identified in donknap dpanel up to 1.6.0. This issue affects some unknown processing. Executing a manipulation can lead to hard-coded key. This vulnerability is tracked as CVE-2025-30206. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in donknap dpanel up to 1.6.0. It has been declared as critical. This vulnerability affects an unknown code block. The manipulation with an unknown input leads to a hard-coded key vulnerability. The CWE definition for the vulnerability is CWE-321. The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Dpanel is a Docker visualization panel system which provides complete Docker management functions. The Dpanel service contains a hardcoded JWT secret in its default configuration, allowing attackers to generate valid JWT tokens and compromise the host machine. This security flaw allows attackers to analyze the source code, discover the embedded secret, and craft legitimate JWT tokens. By forging these tokens, an attacker can successfully bypass authentication mechanisms, impersonate privileged users, and gain unauthorized administrative access. Consequently, this enables full control over the host machine, potentially leading to severe consequences such as sensitive data exposure, unauthorized command execution, privilege escalation, or further lateral movement within the network environment. This issue is patched in version 1.6.1. A workaround for this vulnerability involves replacing the hardcoded secret with a securely generated value and load it from secure configuration storage.

The advisory is shared for download at github.com. This vulnerability was named CVE-2025-30206 since 03/18/2025. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.001.

Upgrading to version 1.6.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• donknap

Name

• dpanel

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6.0

Website

• Product: https://github.com/donknap/dpanel/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion