Live › vulnerability › CVE-2026-116810
Go to dashboardOpenPanel before 3.0.0 exposes its public reference.getChartReferences tRPC procedure without an authorization check. An unauthenticated attacker who guesses slug-based project IDs can read any project's annotation titles, descriptions and dates, such as release notes and deploy markers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Self-hosted OpenPanel instances below 3.0.0 that serve the tRPC API to the internet, where project slugs can be guessed. Instances behind authentication at the network edge, or on 3.0.0 and later, are not exposed by this flaw.
No product ranges from the sources yet.
3.0.0.reference.getChartReferences on your deployment, reachable without a session.3.0.0 or later.reference.getChartReferences at the reverse proxy.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers can send requests with guessable slug-based project IDs to dump cross-tenant annotation titles, descriptions, and dates such as release notes and deploy markers.
This page as .md · .json · in your agent: get_signal("CVE-2026-116810")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.