CVE-2026-116813: OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts

Q: Who can exploit this issue?

An attacker needs either project-read membership or access to a share link. The issue can be exploited remotely without user interaction once that level of access is available.

Q: What data could be exposed?

An attacker can inject SQL through event series names or startDate/endDate values and use conditions such as OR 1=1 to bypass project_id scoping. This can allow reading analytics data belonging to other tenants.

Q: Which deployments are affected?

OpenPanel versions before 3.0.0 are affected. The provided information does not identify any configuration prerequisite beyond access to the vulnerable conversion functionality.

Q: How can I identify possible exploitation?

Review ConversionService.getConversion requests for suspicious series-name or date parameter values containing quote characters or SQL expressions such as OR 1=1. Also investigate unexpected cross-project or cross-tenant analytics query results.

Published Oct 26, 2026

Updated

OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can break out of string literals in series names or startDate/endDate values with OR 1=1 to neutralize projectid scoping and read other tenants' analytics data.

Affected Software

1 affected component

OpenPanel OpenPanel<3.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenPanel to a version that resolves this vulnerability.
Fixed in 3.0.0

Event History

Oct 26, 2026

CVE Published

via MITRE·11:05 PM

Data Sourced

via MITRE·11:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs either project-read membership or access to a share link. The issue can be exploited remotely without user interaction once that level of access is available.

What data could be exposed?

An attacker can inject SQL through event series names or startDate/endDate values and use conditions such as OR 1=1 to bypass project_id scoping. This can allow reading analytics data belonging to other tenants.

Which deployments are affected?

OpenPanel versions before 3.0.0 are affected. The provided information does not identify any configuration prerequisite beyond access to the vulnerable conversion functionality.

How can I identify possible exploitation?

Review ConversionService.getConversion requests for suspicious series-name or date parameter values containing quote characters or SQL expressions such as OR 1=1. Also investigate unexpected cross-project or cross-tenant analytics query results.

CVE-2026-116813: OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What data could be exposed?

Which deployments are affected?

How can I identify possible exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What data could be exposed?

Which deployments are affected?

How can I identify possible exploitation?