Live › vulnerability › CVE-2026-116814
Go to dashboardOpenPanel before 3.0.0 writes database connection URLs and email template data to standard output logs. Anyone who can read those logs can take database credentials from migration startup output and password-reset tokens when SMTP_HOST and RESEND_API_KEY are unset.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Teams that self-host OpenPanel below 3.0.0 and can read its stdout logs, or ship those logs to a shared log platform. Deployments that configure SMTP_HOST or RESEND_API_KEY may avoid the token exposure, but the database URL logging is described without that condition, so the upgrade still applies.
No product ranges from the sources yet.
unknown if the sources do not say how to read it)SMTP_HOST and RESEND_API_KEY are set in the environment; if neither is set, password-reset emails fall back to logging3.0.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access can obtain database credentials from migration startup logs and password-reset tokens logged when SMTP_HOST and RESEND_API_KEY are unset.
This page as .md · .json · in your agent: get_signal("CVE-2026-116814")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.