Read the docs
TI-2026-80972 Aliases CVE-2026-116807GHSA-4c79-56xr-vg4w

SQL injection in OpenPanel lets users read events from all projects

Priority MEDIUM 64CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

OpenPanel before 3.0.0 is affected. Profile filter names are not escaped before they are placed in a JOIN subquery, which is an SQL injection flaw (CWE-89). An authenticated user with low privileges can bypass project scoping and read events from all projects.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Description from the CNA

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the project_id WHERE clause and read events from all projects.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00267 18th percentileScored 2026-11-07
Fix Fixed openpanel (Openpanel-dev): 3.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Openpanel-devopenpanelbefore 3.0.03.0.0Patch availableCNA
  • openpanel VendorOpenpanel-dev Affected before 3.0.0 Fixed in 3.0.0 Patch available CNA

Remediation

Upgrade Openpanel-dev openpanel to version 3.0.0, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

  • Fix · CNA openpanel (Openpanel-dev) Fixed in 3.0.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Openpanel-dev openpanel 3.0.0

    14 records Highest priority Priority HIGH 4 HIGH, 4 MEDIUM, 6 LOW

    Other records, highest priority first

    • TI-2026-80976 Sandbox escape in OpenPanel webhook JavaScript templates allows code executionPriority HIGH 73
    • TI-2026-80973 SQL injection in OpenPanel ClickHouse query lets users read other tenants' dataPriority HIGH 72
    • TI-2026-80981 Missing authentication in OpenPanel Bull Board worker dashboardPriority HIGH 70
    Show all 14 records →

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-116807
  2. 2026-10-27 Alias added: GHSA-4c79-56xr-vg4w
  3. 2026-10-27 Priority changed: MEDIUM → LOW
  4. 2026-10-31 CISA SSVC decision points changed
  5. 2026-10-31 Priority changed: LOW → MEDIUM

References

Patch 1

Advisory 1

  • TI-2026-63244 OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE CVSS 4.0CRITICAL 9.4
  • TI-2026-80976 Sandbox escape in OpenPanel webhook JavaScript templates allows code execution CVSS 4.0HIGH 8.7
  • TI-2026-80973 SQL injection in OpenPanel ClickHouse query lets users read other tenants' data CVSS 4.0HIGH 8.6
  • TI-2026-80981 Missing authentication in OpenPanel Bull Board worker dashboard CVSS 4.0MEDIUM 6.9
  • TI-2026-80975 Missing authorization in OpenPanel exposes project chart annotations CVSS 4.0MEDIUM 6.9
  • TI-2026-63243 OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret CVSS 4.0MEDIUM 6.9
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences