Read the docs
TI-2026-80978 Aliases CVE-2026-116813GHSA-4m7v-v664-jv5c

SQL injection in OpenPanel ClickHouse conversion queries

Priority LOW 31CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

OpenPanel before 3.0.0 contains an SQL injection flaw in ConversionService.getConversion, where event names and dates are not escaped before being placed in ClickHouse queries (CWE-89). A user with project-read access or a holder of a share link can break out of string literals with crafted series names or date values to bypass project_id scoping and read other tenants' analytics data. The CVSS 4.0 vector rates the flaw as network-reachable with low privileges required and high confidentiality impact.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can break out of string literals in series names or startDate/endDate values with OR 1=1 to neutralize project_id scoping and read other tenants' analytics data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00234 14th percentileScored 2026-11-07
Fix Fixed openpanel (Openpanel-dev): 3.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Openpanel-devopenpanelbefore 3.0.03.0.0Patch availableCNA
  • openpanel VendorOpenpanel-dev Affected before 3.0.0 Fixed in 3.0.0 Patch available CNA

Remediation

Upgrade OpenPanel to version 3.0.0 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA openpanel (Openpanel-dev) Fixed in 3.0.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Openpanel-dev openpanel 3.0.0

    14 records Highest priority Priority HIGH 4 HIGH, 4 MEDIUM, 6 LOW

    Other records, highest priority first

    • TI-2026-80976 Sandbox escape in OpenPanel webhook JavaScript templates allows code executionPriority HIGH 73
    • TI-2026-80973 SQL injection in OpenPanel ClickHouse query lets users read other tenants' dataPriority HIGH 72
    • TI-2026-80981 Missing authentication in OpenPanel Bull Board worker dashboardPriority HIGH 70
    Show all 14 records →

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-116813
  2. 2026-10-27 CISA SSVC decision points changed
  3. 2026-10-27 Priority changed: MEDIUM → LOW
  4. 2026-10-27 Alias added: GHSA-4m7v-v664-jv5c

References

Advisory 1

  • TI-2026-63244 OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE CVSS 4.0CRITICAL 9.4
  • TI-2026-80976 Sandbox escape in OpenPanel webhook JavaScript templates allows code execution CVSS 4.0HIGH 8.7
  • TI-2026-80973 SQL injection in OpenPanel ClickHouse query lets users read other tenants' data CVSS 4.0HIGH 8.6
  • TI-2026-80981 Missing authentication in OpenPanel Bull Board worker dashboard CVSS 4.0MEDIUM 6.9
  • TI-2026-80975 Missing authorization in OpenPanel exposes project chart annotations CVSS 4.0MEDIUM 6.9
  • TI-2026-63243 OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret CVSS 4.0MEDIUM 6.9
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences