CVE-2026-93982: OpenPanel MCP Authentication Token in Query Parameter Logged Plaintext
OpenPanel through commit bad75bdd writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and access project analytics.
Affected Software
Event History
Frequently Asked Questions
Who can exploit the exposed credentials?
An attacker needs access to the application's stdout or to a centralized logging system that receives its logs. They can capture the base64-encoded MCP authentication tokens recorded there.
What can an attacker do with a captured token?
Captured tokens can be replayed to make MCP requests and access project analytics.
How can teams determine whether they may be affected?
Review application stdout and centralized logs for MCP authentication tokens appearing in URL query parameters. The issue is described as affecting OpenPanel through commit bad75bdd.