CVE-2026-116817GHSA-r627-6vrh-65p9
OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board
Openpanel-dev openpanel
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 3.0.0openpanelCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data, metrics, and datastore health.
Text from CVE List
Affected versions 2
- openpanelaffected: all versions before 3.0.0CVE List
- openpanelunaffected: 3.0.0CVE List
References 4
- github.com/Openpanel-dev/openpanel/commit/fb0b56977c82aa1ade61449df86726b0c1490f54Fixvia CVE List
- github.com/Openpanel-dev/openpanel/commit/193e1e3ae01aa5208b3bee754ddee2c7ce33b38dFixvia CVE List
- github.com/Openpanel-dev/openpanel/security/advisories/GHSA-r627-6vrh-65p9Advisoryvia CVE List
- vulncheck.com/advisories/openpanel-before-3.0.0-missing-authentication-on-worker-bull-boardAdvisoryvia CVE List