CVE-2026-116817: OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board

Q: Which deployments are exposed to unauthenticated access?

OpenPanel deployments before 3.0.0 are exposed if the worker HTTP port serving Bull Board is reachable by an attacker. The affected dashboard allows access without authentication.

Q: What can an unauthenticated attacker do through the exposed dashboard?

An attacker can query /api/queues, read queue data, metrics, and datastore health, and invoke Bull Board APIs to add, retry, or clean jobs.

Q: How can I check whether a deployment is affected?

Check whether the OpenPanel version is earlier than 3.0.0 and whether the worker HTTP port exposes the Bull Board dashboard. Attempting to access the dashboard or /api/queues without authentication can identify the exposure.

Published Oct 26, 2026

Updated

OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data, metrics, and datastore health.

Affected Software

1 affected component

OpenPanel OpenPanel<3.0.0

Event History

Oct 26, 2026

CVE Published

via MITRE·11:05 PM

Data Sourced

via MITRE·11:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to unauthenticated access?

OpenPanel deployments before 3.0.0 are exposed if the worker HTTP port serving Bull Board is reachable by an attacker. The affected dashboard allows access without authentication.

What can an unauthenticated attacker do through the exposed dashboard?

An attacker can query /api/queues, read queue data, metrics, and datastore health, and invoke Bull Board APIs to add, retry, or clean jobs.

How can I check whether a deployment is affected?

Check whether the OpenPanel version is earlier than 3.0.0 and whether the worker HTTP port exposes the Bull Board dashboard. Attempting to access the dashboard or /api/queues without authentication can identify the exposure.

CVE-2026-116817: OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to unauthenticated access?

What can an unauthenticated attacker do through the exposed dashboard?

How can I check whether a deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to unauthenticated access?

What can an unauthenticated attacker do through the exposed dashboard?

How can I check whether a deployment is affected?