OpenPanel: SQL injection via profile.values allows cross-tenant data read
Summary
OpenPanel before 3.0.0 contains an SQL injection in the profile.values query. The user-supplied property is inserted unescaped into a ClickHouse SELECT expression. An authenticated user can append their own FROM and WHERE clauses to read profiles, events and sessions of other projects on the same instance. The CVSS vector assumes high privileges, while the advisory describes any authenticated user; the exact requirement should be confirmed in the GitHub advisory.
Affected
- OpenPanel versions 0 to before 3.0.0 (Openpanel-dev/openpanel)
Fixed in
- Upgrade to OpenPanel 3.0.0 or later.
- Upstream fix: commit a2aa053cb23e92967e812d3be5fb0f1d606d9fdc
Workaround
- Unknown. The vendor documents no workaround.
- Until the upgrade: limit login accounts to trusted users, remove unused accounts and do not expose the instance to untrusted users.
Exploitation
- No evidence of exploitation in the wild in the sources checked.
- No public exploit code or Metasploit module found.
- One source states it is not listed in CISA KEV; this was not verified on the CISA site.
Our recommendation
- Upgrade all OpenPanel instances to 3.0.0 or later; this release also covers related CVEs in the same batch.
- Until then, restrict accounts and do not expose the dashboard to untrusted users.
- Check whether the instance is shared between projects, clients or departments; the risk is higher in that case.
- Review access logs for unusual profile.values requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-4j6c-j6vc-xq96 github.com
- Upstream fix commit a2aa053 github.com
- VulnCheck advisory www.vulncheck.com
- OpenCVE CVE-2026-116808 app.opencve.io
- Strix CVE-2026-116808 www.strix.ai
- Offseq threat radar entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:03.
Original description (NVD)
OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the project_id scope to exfiltrate other projects' profiles, events, and sessions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.