SQL Injection Vulnerability in OpenPanel by OpenPanel Dev
CVE-2026-116812

7.1HIGH

Key Information:

Vendor

Openpanel-dev

Status
Openpanel
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116812?

OpenPanel versions prior to 3.0.0 are susceptible to SQL injection attacks via the profileColumnAccess method in cohort.service.ts. This vulnerability enables project-read members to manipulate SQL commands by supplying unescaped profile filter column names. Attackers can exploit this flaw by injecting a cohort.preview filter that incorporates a subquery into argMax, cityHash64, or comparison clauses, thereby gaining potential access to unauthorized ClickHouse data belonging to other tenants. It's crucial for users to upgrade to the latest version to mitigate this security risk.

Affected Version(s)

openpanel 0 < 3.0.0

openpanel 3.0.0

References

https://github.com/Openpanel-dev/openpanel/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/openpanel-before-3.0...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
.