CVE-2026-116807GHSA-pc3q-gw7f-p2x2
OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query
Openpanel-dev openpanel
CVSS
7.0HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 3.0.0openpanelCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the project_id WHERE clause and read events from all projects.
Text from CVE List
Affected versions 2
- openpanelaffected: all versions before 3.0.0CVE List
- openpanelunaffected: 3.0.0CVE List
References 3
- github.com/Openpanel-dev/openpanel/commit/a2aa053cb23e92967e812d3be5fb0f1d606d9fdcFixvia CVE List
- github.com/Openpanel-dev/openpanel/security/advisories/GHSA-pc3q-gw7f-p2x2Advisoryvia CVE List
- vulncheck.com/advisories/openpanel-before-3.0.0-clickhouse-sql-injection-via-event-events-trpc-queryAdvisoryvia CVE List