OpenPanel: SQL injection in ClickHouse queries via live visitors WebSocket
Summary
OpenPanel before 3.0.0 contains SQL injection in ClickHouse queries. The projectId parameter of the /live/visitors/:projectId WebSocket is inserted unescaped into SQL and the endpoint performs no session or project-access check. An unauthenticated remote attacker can use UNION or boolean count techniques to read other tenants' events and profiles. Project members can also inject SQL through cohort.preview timeframe values.
Affected
- OpenPanel versions before 3.0.0 (CNA: affected 0 to < 3.0.0)
Fixed in
- Upgrade to OpenPanel 3.0.0 or later (CNA data and vendor patch commit reference 3.0.0).
- Ambiguity: a maintainer note says the live-visitors WebSocket still lacks a session check, so verify the fix after upgrading.
Workaround
- Restrict /live/visitors/* at a firewall or API gateway to trusted IP ranges or authenticated clients until the upgrade is verified.
- This is a generic mitigation, not an official vendor fix.
Exploitation
- CISA SSVC: exploitation 'none', automatable 'yes'.
- Not listed in the CISA KEV catalog.
- No public proof of concept or exploitation reports found in a limited search. Treat as 'nothing known so far', not as confirmed absent.
Our recommendation
- Check whether any OpenPanel instance is reachable from the internet. Priority is high if it is.
- Upgrade to 3.0.0 or later, then confirm that the live-visitors WebSocket rejects unauthenticated access.
- Restrict the /live/visitors/* endpoint at the gateway until the upgrade is verified.
- Review ClickHouse and application logs for unusual requests to this endpoint.
- Check whether other OpenPanel CVEs of the same release batch apply; 3.0.0 is listed as the fix for them as well.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub patch commit 35ddc8e github.com
- GitHub Security Advisory GHSA-8wr9-x797-f238 github.com
- VulnCheck advisory www.vulncheck.com
- OpenPanel pull request 511 github.com
- OpenCVE CVE-2026-116818 app.opencve.io
- Strix CVE-2026-116818 www.strix.ai
- ThreatInt CVE-2026-116818 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:22.
Original description (NVD)
OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count oracles to read other tenants' events and profiles, and project members can similarly inject via the cohort.preview timeframe values.
NVD references (3)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.