CVE-2026-93983: OpenPanel SQL Injection via ClickHouse Property Key Filter
OpenPanel through commit bad75bdd fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be an authenticated OpenPanel user and able to supply crafted property-key filter names. The issue is remotely reachable and does not require user interaction.
What is the practical impact?
Crafted boolean SQL terms can bypass project isolation, allowing an authenticated user to access metrics belonging to other projects. The provided impact information indicates confidentiality exposure, with no stated integrity or availability impact.
Are default deployments affected?
The provided information does not identify a configuration prerequisite or mitigation setting. Deployments running OpenPanel through commit bad75bdd should be treated as potentially affected.