CVE-2026-116807: OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query

Q: Which versions need remediation?

OpenPanel versions before 3.0.0 are affected.

Q: Does an attacker need access to an account?

Yes. Exploitation requires an authenticated user with the ability to submit a crafted profile filter name through the affected query.

Q: What is the impact if exploitation succeeds?

An attacker can bypass project tenant scoping and read event data from all projects.

Published Oct 26, 2026

Updated

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the projectid WHERE clause and read events from all projects.

Affected Software

1 affected component

OpenPanel OpenPanel<3.0.0

Event History

Oct 26, 2026

CVE Published

via MITRE·11:05 PM

Data Sourced

via MITRE·11:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which versions need remediation?

OpenPanel versions before 3.0.0 are affected.

Does an attacker need access to an account?

Yes. Exploitation requires an authenticated user with the ability to submit a crafted profile filter name through the affected query.

What is the impact if exploitation succeeds?

An attacker can bypass project tenant scoping and read event data from all projects.

CVE-2026-116807: OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query

Affected Software

Event History

Frequently Asked Questions

Which versions need remediation?

Does an attacker need access to an account?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which versions need remediation?

Does an attacker need access to an account?

What is the impact if exploitation succeeds?