SQL Injection Vulnerability in OpenPanel Affected by ClickHouse Integration
CVE-2026-93983

5.3MEDIUM

Key Information:

Vendor

Openpanel-dev

Status
Openpanel
Vendor
CVE Published:
19 September 2026

What is CVE-2026-93983?

An SQL injection vulnerability exists in OpenPanel due to improper escaping of property keys in ClickHouse SQL queries. Authenticated users can exploit this flaw to inject boolean SQL terms by providing maliciously crafted filter names. This attack enables the circumvention of project isolation, allowing unauthorized access to sensitive metrics from other projects within the system.

Affected Version(s)

openpanel 0

References

https://github.com/Openpanel-dev/openpanel/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/openpanel-sql-inject...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

CaptBoykin
.