CVE-2026-116808: OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values

Q: Who can exploit this issue?

An authenticated OpenPanel user can exploit it by submitting a crafted property parameter to profile.values. The provided information does not indicate that unauthenticated users can exploit it.

Q: What data could be exposed or altered?

An attacker can bypass the project_id scope and read data from other tenants, including profiles, events, and sessions. The supplied severity vector also rates confidentiality, integrity, and availability impact as high, but the description specifically describes cross-tenant data exfiltration.

Q: Which versions require remediation?

OpenPanel versions before 3.0.0 are affected. Upgrade to 3.0.0 or later if available in your deployment path.

Q: How does the SQL injection bypass tenant isolation?

The attacker supplies a crafted property parameter to profile.values that injects a SELECT expression with attacker-controlled FROM and WHERE clauses. They can then comment out the project_id filter that normally limits queries to their own project.

Published Oct 26, 2026

Updated

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the projectid scope to exfiltrate other projects' profiles, events, and sessions.

Affected Software

1 affected component

OpenPanel OpenPanel<3.0.0

Event History

Oct 26, 2026

CVE Published

via MITRE·11:05 PM

Data Sourced

via MITRE·11:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated OpenPanel user can exploit it by submitting a crafted property parameter to profile.values. The provided information does not indicate that unauthenticated users can exploit it.

What data could be exposed or altered?

An attacker can bypass the project_id scope and read data from other tenants, including profiles, events, and sessions. The supplied severity vector also rates confidentiality, integrity, and availability impact as high, but the description specifically describes cross-tenant data exfiltration.

Which versions require remediation?

OpenPanel versions before 3.0.0 are affected. Upgrade to 3.0.0 or later if available in your deployment path.

How does the SQL injection bypass tenant isolation?

The attacker supplies a crafted property parameter to profile.values that injects a SELECT expression with attacker-controlled FROM and WHERE clauses. They can then comment out the project_id filter that normally limits queries to their own project.

CVE-2026-116808: OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What data could be exposed or altered?

Which versions require remediation?

How does the SQL injection bypass tenant isolation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What data could be exposed or altered?

Which versions require remediation?

How does the SQL injection bypass tenant isolation?