Live › vulnerability › CVE-2026-116812
Go to dashboardOpenPanel before 3.0.0 does not escape profile filter column names in the cohort service, so SQL in a cohort.preview filter is executed. An attacker with project-read access can use this to read other tenants' ClickHouse data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Self-hosted or multi-tenant OpenPanel instances before 3.0.0 where users hold project-read membership can reach the cohort filter path. Single-tenant deployments with no untrusted project-read users have less exposure to the cross-tenant read.
No product ranges from the sources yet.
3.0.0 are affected.3.0.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members to inject SQL by supplying unescaped profile filter column names. Attackers can submit a cohort.preview filter whose name contains a subquery spliced into argMax, cityHash64, or comparison clauses to read other tenants' ClickHouse data.
This page as .md · .json · in your agent: get_signal("CVE-2026-116812")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.