Live › vulnerability › CVE-2026-116805
Go to dashboardOpenPanel before 3.0.0 returns full client rows, including the argon2id hash of each ingestion credential, from the client.list tRPC query. A read-only project member can request them and check leaked secrets offline without leaving an audit trail.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Teams that self-host OpenPanel below 3.0.0 and give read-level project access to people who should not see ingestion credentials. Deployments on or later are not affected by this flaw, and single-user setups without read-only members carry little exposure.
3.0.0No product ranges from the sources yet.
unknown for the exact command, the sources do not say how it is deployed.3.0.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the client.list tRPC query. Attackers can request client.list with a project ID and receive full Client rows including the secret column, enabling offline verification of leaked secrets without audit trails.
This page as .md · .json · in your agent: get_signal("CVE-2026-116805")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.