CVE-2026-116814: OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs

Q: Who can exploit this issue in practice?

An attacker needs access to the application's standard output logs. Those logs may expose database connection URLs from migration startup and password-reset token data under the affected email configuration.

Q: What configuration makes password-reset tokens appear in logs?

Password-reset tokens are logged when both SMTP_HOST and RESEND_API_KEY are unset. In that configuration, anyone able to read the relevant logs may obtain token data.

Q: What is the immediate mitigation if upgrading is not possible?

Restrict access to standard output logs and treat any exposed database credentials or password-reset tokens as compromised. Configure SMTP_HOST or RESEND_API_KEY to avoid the described password-reset logging condition.

Q: How can I determine whether my deployment is affected?

Deployments running OpenPanel versions before 3.0.0 are affected. Review standard output logs for database connection URLs during migration startup and for password-reset token or email template data, particularly if SMTP_HOST and RESEND_API_KEY are unset.

Published Oct 26, 2026

Updated

OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access can obtain database credentials from migration startup logs and password-reset tokens logged when SMTPHOST and RESENDAPIKEY are unset.

Affected Software

1 affected component

OpenPanel OpenPanel<3.0.0

Event History

Oct 26, 2026

CVE Published

via MITRE·11:05 PM

Data Sourced

via MITRE·11:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue in practice?

An attacker needs access to the application's standard output logs. Those logs may expose database connection URLs from migration startup and password-reset token data under the affected email configuration.

What configuration makes password-reset tokens appear in logs?

Password-reset tokens are logged when both SMTP_HOST and RESEND_API_KEY are unset. In that configuration, anyone able to read the relevant logs may obtain token data.

What is the immediate mitigation if upgrading is not possible?

Restrict access to standard output logs and treat any exposed database credentials or password-reset tokens as compromised. Configure SMTP_HOST or RESEND_API_KEY to avoid the described password-reset logging condition.

How can I determine whether my deployment is affected?

Deployments running OpenPanel versions before 3.0.0 are affected. Review standard output logs for database connection URLs during migration startup and for password-reset token or email template data, particularly if SMTP_HOST and RESEND_API_KEY are unset.

CVE-2026-116814: OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue in practice?

What configuration makes password-reset tokens appear in logs?

What is the immediate mitigation if upgrading is not possible?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue in practice?

What configuration makes password-reset tokens appear in logs?

What is the immediate mitigation if upgrading is not possible?

How can I determine whether my deployment is affected?