CVE-2026-116814GHSA-xr2x-w49w-hp2c
OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs
Openpanel-dev openpanel
CVSS
7.1HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 3.0.0openpanelCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access can obtain database credentials from migration startup logs and password-reset tokens logged when SMTP_HOST and RESEND_API_KEY are unset.
Text from CVE List
Affected versions 2
- openpanelaffected: all versions before 3.0.0CVE List
- openpanelunaffected: 3.0.0CVE List
References 4
- github.com/Openpanel-dev/openpanel/commit/337b4ff8fe268c769a075a2e53206d54045cb2d5Fixvia CVE List
- github.com/Openpanel-dev/openpanel/commit/b197f024388060e37ef3b3dad43451a3d0a5d501Fixvia CVE List
- github.com/Openpanel-dev/openpanel/security/advisories/GHSA-xr2x-w49w-hp2cAdvisoryvia CVE List
- vulncheck.com/advisories/openpanel-before-3.0.0-sensitive-information-exposure-via-application-logsAdvisoryvia CVE List