Unauthenticated SQL Injection in OpenPanel WebSocket
CVE-2026-116818

8.8HIGH

Key Information:

Vendor

Openpanel-dev

Status
Openpanel
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116818?

OpenPanel versions prior to 3.0.0 are susceptible to an unauthenticated SQL injection vulnerability through the /live/visitors/:projectId WebSocket endpoint. This flaw arises from missing session and project access validations, allowing remote attackers to exploit the projectId parameter. Attackers can execute SQL queries using UNION or boolean count oracles, potentially exposing events and profiles of other tenants. Additionally, project members may exploit the vulnerability via cohort.preview timeframe values, increasing the risk of data leakage.

Affected Version(s)

openpanel 0 < 3.0.0

openpanel 3.0.0

References

https://github.com/Openpanel-dev/openpanel/security/advis...
vendor-advisory
https://github.com/Openpanel-dev/openpanel/commit/35ddc8e...
patch
https://www.vulncheck.com/advisories/openpanel-before-3.0...
third-party-advisory

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hackchang
.