Live › vulnerability › CVE-2026-116815
Go to dashboardOpenPanel before 3.0.0 fails to escape backslashes in event names used in a ClickHouse query for its Sankey chart. An authenticated project member can submit crafted event names that cause ClickHouse parse errors and disable the project's Sankey chart endpoint.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Self-hosted or managed OpenPanel installs running a version before . The flaw needs a logged-in project member who can read the project, and the impact is limited to the Sankey chart endpoint for that project. Teams on or later can skip it.
3.0.03.0.0No product ranges from the sources yet.
package.json or the image tag; unknown if the sources do not give a command.chart.sankey procedure is reachable for your projects; unknown if the sources do not say how.3.0.0 or later, per the NVD entry for CVE-2026-116815.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can submit crafted events[].name values to the chart.sankey procedure, causing ClickHouse parse errors that disable the project's Sankey chart endpoint.
This page as .md · .json · in your agent: get_signal("CVE-2026-116815")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.