CVE-2026-116805: OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list

Q: Who can retrieve the ingestion secret hashes?

Any project member with read-level access can query client.list for that project and receive full Client records containing the secret column.

Q: What does an attacker need to exploit this issue?

The attacker needs read-level membership in a project and its project ID. Exploitation is network-accessible and does not require user interaction.

Q: Which versions are affected?

OpenPanel versions before 3.0.0 are affected. Upgrading to 3.0.0 or later removes the affected behavior.

Q: What can an attacker do with the disclosed values?

The returned values are argon2id hashes of ingestion credentials. An attacker can use them for offline verification of secrets that may already have been leaked, without generating audit trails.

Published Oct 26, 2026

Updated

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the client.list tRPC query. Attackers can request client.list with a project ID and receive full Client rows including the secret column, enabling offline verification of leaked secrets without audit trails.

Affected Software

1 affected component

OpenPanel OpenPanel<3.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenPanel to a version that resolves this vulnerability.
Fixed in 3.0.0

Event History

Oct 26, 2026

CVE Published

via MITRE·11:05 PM

Data Sourced

via MITRE·11:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can retrieve the ingestion secret hashes?

Any project member with read-level access can query client.list for that project and receive full Client records containing the secret column.

What does an attacker need to exploit this issue?

The attacker needs read-level membership in a project and its project ID. Exploitation is network-accessible and does not require user interaction.

Which versions are affected?

OpenPanel versions before 3.0.0 are affected. Upgrading to 3.0.0 or later removes the affected behavior.

What can an attacker do with the disclosed values?

The returned values are argon2id hashes of ingestion credentials. An attacker can use them for offline verification of secrets that may already have been leaked, without generating audit trails.

CVE-2026-116805: OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can retrieve the ingestion secret hashes?

What does an attacker need to exploit this issue?

Which versions are affected?

What can an attacker do with the disclosed values?

Company

Resources

Contact

Frequently Asked Questions

Who can retrieve the ingestion secret hashes?

What does an attacker need to exploit this issue?

Which versions are affected?

What can an attacker do with the disclosed values?