CVE-2026-116805GHSA-78w9-wwff-vxqc
OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list
Openpanel-dev openpanel
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 3.0.0openpanelCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the client.list tRPC query. Attackers can request client.list with a project ID and receive full Client rows including the secret column, enabling offline verification of leaked secrets without audit trails.
Text from CVE List
Affected versions 2
- openpanelaffected: all versions before 3.0.0CVE List
- openpanelunaffected: 3.0.0CVE List
References 3
- github.com/Openpanel-dev/openpanel/commit/e37d15cc2a2c908667593ff7a2ee40750f74ab5bFixvia CVE List
- github.com/Openpanel-dev/openpanel/security/advisories/GHSA-78w9-wwff-vxqcAdvisoryvia CVE List
- vulncheck.com/advisories/openpanel-before-3.0.0-information-disclosure-of-ingestion-secret-hashes-via-client-listAdvisoryvia CVE List