NVD security advisory
Security advisory for OpenPanel
CVE-2026-116818
Full advisory details, affected packages, severity context, and original source.
Affected technology
OpenPanelAffected product
Advisory overview
OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count oracles to read other tenants' events and profiles, and project members can similarly inject via the cohort.preview timeframe values.
Related references
- https://github.com/Openpanel-dev/openpanel/commit/35ddc8ebbcd4ed0767933de61f014f153d68442a
- https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-8wr9-x797-f238
- https://www.vulncheck.com/advisories/openpanel-before-3.0.0-unauthenticated-clickhouse-sql-injection-via-live-visitors-websocket