---
id: "CVE-2026-116814"
kind: "vulnerability"
aliases: ["CVE-2026-116814"]
title: "OpenPanel: startup logs leak database URLs and password-reset tokens"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["docker", "logs", "openpanel", "package", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-27T00:17:15+00:00"
first_seen_at: "2026-10-27T00:25:55+00:00"
updated_at: "2026-10-27T00:26:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116814", "first_seen_at": "2026-10-27T00:25:55+00:00"}]
---

# OpenPanel: startup logs leak database URLs and password-reset tokens

OpenPanel before 3.0.0 writes database connection URLs and email template data to standard output logs. Anyone who can read those logs can take database credentials from migration startup output and password-reset tokens when SMTP_HOST and RESEND_API_KEY are unset.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenPanel version in the deployment (`unknown` if the sources do not say how to read it)
- Look at whether `SMTP_HOST` and `RESEND_API_KEY` are set in the environment; if neither is set, password-reset emails fall back to logging
- Search the container or service logs for database connection strings and reset tokens

## Fix

- Upgrade OpenPanel to `3.0.0` or later
- Rotate database credentials if logs were readable by others while the old version ran
- Invalidate outstanding password-reset tokens after upgrading

## Timeline

- 2026-10-27T00:25:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116814

## From the sources

OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access can obtain database credentials from migration startup logs and password-reset tokens logged when SMTP_HOST and RESEND_API_KEY are unset.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_