CVE-2026-116815: OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts

Q: Which users can exploit this issue?

An attacker must be an authenticated member of the target project with read access. The affected input is the events[].name value accepted by the chart.sankey procedure.

Q: What is the practical impact?

Crafted backslashes in event names can break ClickHouse string literals and cause parse errors. This disables the affected project's Sankey chart endpoint; no confidentiality or integrity impact is described.

Q: Which versions are affected?

OpenPanel versions before 3.0.0 are affected. The provided information does not identify a more specific fixed release.

Q: How can I determine whether a project is being targeted or affected?

Check failures for the project's Sankey chart endpoint and ClickHouse parse errors occurring when chart.sankey is called. Review submitted events[].name values for crafted backslashes from authenticated project members.

Published Oct 26, 2026

Updated

OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can submit crafted events[].name values to the chart.sankey procedure, causing ClickHouse parse errors that disable the project's Sankey chart endpoint.

Affected Software

1 affected component

OpenPanel OpenPanel<3.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenPanel to a version that resolves this vulnerability.
Fixed in 3.0.0

Event History

Oct 26, 2026

CVE Published

via MITRE·11:05 PM

Data Sourced

via MITRE·11:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

An attacker must be an authenticated member of the target project with read access. The affected input is the events[].name value accepted by the chart.sankey procedure.

What is the practical impact?

Crafted backslashes in event names can break ClickHouse string literals and cause parse errors. This disables the affected project's Sankey chart endpoint; no confidentiality or integrity impact is described.

Which versions are affected?

OpenPanel versions before 3.0.0 are affected. The provided information does not identify a more specific fixed release.

How can I determine whether a project is being targeted or affected?

Check failures for the project's Sankey chart endpoint and ClickHouse parse errors occurring when chart.sankey is called. Review submitted events[].name values for crafted backslashes from authenticated project members.

CVE-2026-116815: OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts

Affected Software

Remediation

Event History

Frequently Asked Questions

Which users can exploit this issue?

What is the practical impact?

Which versions are affected?

How can I determine whether a project is being targeted or affected?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What is the practical impact?

Which versions are affected?

How can I determine whether a project is being targeted or affected?