CVE-2026-116818: OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket

Q: Who can exploit the vulnerable endpoint?

Any remote attacker can target the /live/visitors/:projectId WebSocket without authentication because it lacks session and project-access checks. Project members can also inject SQL through cohort.preview timeframe values.

Q: What data could an unauthenticated attacker access?

An attacker can use UNION-based injection or boolean count oracles to read events and profiles belonging to other tenants.

Q: Which deployments are affected?

OpenPanel versions before 3.0.0 are affected. The exposed WebSocket endpoint does not require a session or project-access authorization check, so deployments exposing it are at risk.

Q: What should be prioritized if an immediate upgrade is not possible?

Restrict access to the /live/visitors/:projectId WebSocket to trusted clients or disable exposure of the affected live-visitors functionality until the vulnerable version can be replaced. This is particularly important because exploitation requires no authentication.

Published Oct 26, 2026

Updated

OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count oracles to read other tenants' events and profiles, and project members can similarly inject via the cohort.preview timeframe values.

Affected Software

1 affected component

OpenPanel OpenPanel<3.0.0

Event History

Oct 26, 2026

CVE Published

via MITRE·11:05 PM

Data Sourced

via MITRE·11:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit the vulnerable endpoint?

Any remote attacker can target the /live/visitors/:projectId WebSocket without authentication because it lacks session and project-access checks. Project members can also inject SQL through cohort.preview timeframe values.

What data could an unauthenticated attacker access?

An attacker can use UNION-based injection or boolean count oracles to read events and profiles belonging to other tenants.

Which deployments are affected?

OpenPanel versions before 3.0.0 are affected. The exposed WebSocket endpoint does not require a session or project-access authorization check, so deployments exposing it are at risk.

What should be prioritized if an immediate upgrade is not possible?

Restrict access to the /live/visitors/:projectId WebSocket to trusted clients or disable exposure of the affected live-visitors functionality until the vulnerable version can be replaced. This is particularly important because exploitation requires no authentication.

CVE-2026-116818: OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket

Affected Software

Event History

Frequently Asked Questions

Who can exploit the vulnerable endpoint?

What data could an unauthenticated attacker access?

Which deployments are affected?

What should be prioritized if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit the vulnerable endpoint?

What data could an unauthenticated attacker access?

Which deployments are affected?

What should be prioritized if an immediate upgrade is not possible?