{"id":"CVE-2026-116814","kind":"vulnerability","aliases":["CVE-2026-116814"],"related":[],"title":"OpenPanel: startup logs leak database URLs and password-reset tokens","description":"OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access can obtain database credentials from migration startup logs and password-reset tokens logged when SMTP_HOST and RESEND_API_KEY are unset.","summary":"OpenPanel before 3.0.0 writes database connection URLs and email template data to standard output logs. Anyone who can read those logs can take database credentials from migration startup output and password-reset tokens when SMTP_HOST and RESEND_API_KEY are unset.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["docker","logs","openpanel","package","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":"- Check the OpenPanel version in the deployment (`unknown` if the sources do not say how to read it)\n- Look at whether `SMTP_HOST` and `RESEND_API_KEY` are set in the environment; if neither is set, password-reset emails fall back to logging\n- Search the container or service logs for database connection strings and reset tokens","fix":"- Upgrade OpenPanel to `3.0.0` or later\n- Rotate database credentials if logs were readable by others while the old version ran\n- Invalidate outstanding password-reset tokens after upgrading","status":"open","published_at":"2026-10-27T00:17:15+00:00","first_seen_at":"2026-10-27T00:25:55+00:00","triaged_at":"2026-10-27T00:26:22+00:00","updated_at":"2026-10-27T00:26:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T00:26:22Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenPanel to `3.0.0` or later\n- Rotate database credentials if logs were readable by others while the old version ran\n- Invalidate outstanding password-reset tokens after upgrading","reach":"local","title":"OpenPanel: startup logs leak database URLs and password-reset tokens","impact":"high","summary":"OpenPanel before 3.0.0 writes database connection URLs and email template data to standard output logs. Anyone who can read those logs can take database credentials from migration startup output and password-reset tokens when SMTP_HOST and RESEND_API_KEY are unset.","category":"package","nicknames":[],"who_cares":["openpanel","self-hosted","docker","logs"],"confidence":0.6,"needs_auth":"yes","worst_case":"Database credentials and password-reset tokens readable from logs","analyst_note":"Confirm the exact affected versions and the fixed release from the NVD entry or the OpenPanel repository, and check whether the database URL logging depends on the SMTP settings.","how_to_check":"- Check the OpenPanel version in the deployment (`unknown` if the sources do not say how to read it)\n- Look at whether `SMTP_HOST` and `RESEND_API_KEY` are set in the environment; if neither is set, password-reset emails fall back to logging\n- Search the container or service logs for database connection strings and reset tokens","needs_analyst":true,"not_affected_if":["managed-hosting"],"who_is_affected":"Teams that self-host OpenPanel below 3.0.0 and can read its stdout logs, or ship those logs to a shared log platform. Deployments that configure SMTP_HOST or RESEND_API_KEY may avoid the token exposure, but the database URL logging is described without that condition, so the upgrade still applies.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000659,"input_tokens":3317,"output_tokens":655,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116814':14A,17A '-2026':13A,16A '3.0.0':27B,70C 'access':92C 'anyon':40B 'api':64B,112C 'connect':30B,79C 'contain':71C 'credenti':49B,96C 'cve':12A,15A 'data':35B,84C 'databas':5A,29B,48B,78C,95C 'docker':18B 'email':33B,82C 'exposur':74C 'host':24B,61B,109C 'inform':73C 'key':65B,113C 'leak':4A 'log':3A,19B,39B,45B,88C,91C,100C,106C 'migrat':51B,98C 'obtain':94C 'openpanel':1A,20B,25B,68C 'output':38B,53B,87C 'packag':21B 'password':9A,56B,103C 'password-reset':8A,55B,102C 'read':43B 'resend':63B,111C 'reset':10A,57B,104C 'self':23B 'self-host':22B 'smtp':60B,108C 'standard':37B,86C 'startup':2A,52B,99C 'take':47B 'templat':34B,83C 'token':11A,58B,105C 'unset':67B,115C 'url':6A,31B,80C 'user':89C 'vulner':75C 'write':28B,77C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host OpenPanel below 3.0.0 and can read its stdout logs, or ship those logs to a shared log platform. Deployments that configure SMTP_HOST or RESEND_API_KEY may avoid the token exposure, but the database URL logging is described without that condition, so the upgrade still applies.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116814","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116814","severity":null,"published_at":"2026-10-27T00:17:15+00:00","modified_at":"2026-10-27T00:17:15+00:00","first_seen_at":"2026-10-27T00:25:55+00:00","fetched_at":"2026-10-27T00:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}