{"id":"CVE-2026-116810","kind":"vulnerability","aliases":["CVE-2026-116810"],"related":[],"title":"OpenPanel: unauthenticated callers can read other projects' chart annotations","description":"OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers can send requests with guessable slug-based project IDs to dump cross-tenant annotation titles, descriptions, and dates such as release notes and deploy markers.","summary":"OpenPanel before 3.0.0 exposes its public reference.getChartReferences tRPC procedure without an authorization check. An unauthenticated attacker who guesses slug-based project IDs can read any project's annotation titles, descriptions and dates, such as release notes and deploy markers.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["openpanel","package","self-hosted","trpc"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"- Check the installed OpenPanel version; affected builds are anything before `3.0.0`.\n- Look for a public call path to `reference.getChartReferences` on your deployment, reachable without a session.","fix":"- Upgrade OpenPanel to `3.0.0` or later.\n- Until upgraded, block unauthenticated access to the tRPC endpoint that serves `reference.getChartReferences` at the reverse proxy.","status":"open","published_at":"2026-10-27T00:17:13+00:00","first_seen_at":"2026-10-27T00:25:55+00:00","triaged_at":"2026-10-27T00:26:31+00:00","updated_at":"2026-10-27T00:26:31+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T00:26:31Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenPanel to `3.0.0` or later.\n- Until upgraded, block unauthenticated access to the tRPC endpoint that serves `reference.getChartReferences` at the reverse proxy.","reach":"internet","title":"OpenPanel: unauthenticated callers can read other projects' chart annotations","impact":"low","summary":"OpenPanel before 3.0.0 exposes its public reference.getChartReferences tRPC procedure without an authorization check. An unauthenticated attacker who guesses slug-based project IDs can read any project's annotation titles, descriptions and dates, such as release notes and deploy markers.","category":"package","nicknames":[],"who_cares":["openpanel","self-hosted","trpc"],"confidence":0.6,"needs_auth":"no","worst_case":"unauthenticated attacker reads other tenants' annotations and release notes","analyst_note":"","how_to_check":"- Check the installed OpenPanel version; affected builds are anything before `3.0.0`.\n- Look for a public call path to `reference.getChartReferences` on your deployment, reachable without a session.","needs_analyst":false,"not_affected_if":["auth-required","managed-hosting"],"who_is_affected":"Self-hosted OpenPanel instances below 3.0.0 that serve the tRPC API to the internet, where project slugs can be guessed. Instances behind authentication at the network edge, or on 3.0.0 and later, are not exposed by this flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00061,"input_tokens":3346,"output_tokens":551,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116810':12A,15A '-2026':11A,14A '3.0.0':24B,64C 'allow':71C 'annot':9A,50B,79C,103C 'attack':37B,73C,87C 'author':33B,68C 'base':42B,95C 'call':81C 'caller':3A 'chart':8A 'check':34B 'contain':65C 'cross':101C 'cross-ten':100C 'cve':10A,13A 'date':54B,107C 'deploy':60B,113C 'descript':52B,105C 'dump':99C 'expos':25B 'guess':39B 'guessabl':92C 'host':20B 'id':44B,97C 'marker':61B,114C 'miss':67C 'note':58B,111C 'openpanel':1A,16B,22B,62C 'packag':17B 'procedur':30B,86C 'project':7A,43B,48B,77C,96C 'public':27B,83C 'read':5A,46B,75C 'reference.getchartreferences':28B,84C 'releas':57B,110C 'request':90C 'self':19B 'self-host':18B 'send':89C 'slug':41B,94C 'slug-bas':40B,93C 'tenant':102C 'titl':51B,104C 'trpc':21B,29B,85C 'unauthent':2A,36B,72C 'vulner':69C 'without':31B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted OpenPanel instances below 3.0.0 that serve the tRPC API to the internet, where project slugs can be guessed. Instances behind authentication at the network edge, or on 3.0.0 and later, are not exposed by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116810","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116810","severity":null,"published_at":"2026-10-27T00:17:13+00:00","modified_at":"2026-10-27T00:17:14+00:00","first_seen_at":"2026-10-27T00:25:55+00:00","fetched_at":"2026-10-27T00:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}