Unsafe first setup of administrator credentials on fully exposed website #1246

New Issue

MrUnknownDE · 2026-04-05T18:36:42+02:00

MrUnknownDE commented

2026-04-05 18:36:42 +02:00

Originally created by @ackalker on 7/11/2025

The current installation process requires setting up administrator credentials via a web browser, leaving the Pangolin server unsecured and fully exposed to the internet during this period. This creates a critical security window where an attacker could claim the administrator account and gain access to all proxied resources.

Previously, administrator setup was handled securely via the terminal (see commit d03f452). I strongly recommend restoring this option or, at minimum, providing a way to restrict or protect the initial web-based setup (e.g., setup tokens, IP whitelisting, or time-limited URLs).

Potential Impact:

Unauthorized control of Pangolin instance
Exposure of all connected services
Possible lateral movement within private networks

Recommendations:

Restore terminal-based admin setup
Make web-based setup optional or protected
Consider additional mitigations to limit attack surface during setup

*Originally created by @ackalker on 7/11/2025* The current installation process requires setting up administrator credentials via a web browser, leaving the Pangolin server unsecured and fully exposed to the internet during this period. This creates a critical security window where an attacker could claim the administrator account and gain access to all proxied resources. Previously, administrator setup was handled securely via the terminal (see commit d03f452). I strongly recommend restoring this option or, at minimum, providing a way to restrict or protect the initial web-based setup (e.g., setup tokens, IP whitelisting, or time-limited URLs). Potential Impact: - Unauthorized control of Pangolin instance - Exposure of all connected services - Possible lateral movement within private networks Recommendations: - Restore terminal-based admin setup - Make web-based setup optional or protected - Consider additional mitigations to limit attack surface during setup

MrUnknownDE closed this issue

2026-04-05 18:36:42 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1246