Live › vulnerability › CVE-2026-116813
Go to dashboardOpenPanel before 3.0.0 builds ClickHouse queries in ConversionService.getConversion from unescaped event names and dates. An attacker with project-read access or a share link can break out of string literals and read other projects' analytics.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Self-hosted or hosted OpenPanel installations running a version before . Exposure requires a project-read member or a share-link holder, so instances with no shared access carry less risk, but the affected code path is the conversion query, which the sources do not say is reachable only through share links.
3.0.0No product ranges from the sources yet.
unknown whether the sources give a deployment check beyond the version.3.0.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can break out of string literals in series names or startDate/endDate values with OR 1=1 to neutralize project_id scoping and read other tenants' analytics data.
This page as .md · .json · in your agent: get_signal("CVE-2026-116813")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.