{"id":"CVE-2026-116815","kind":"vulnerability","aliases":["CVE-2026-116815"],"related":[],"title":"OpenPanel: backslashes in event names break Sankey chart queries","description":"OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can submit crafted events[].name values to the chart.sankey procedure, causing ClickHouse parse errors that disable the project's Sankey chart endpoint.","summary":"OpenPanel before 3.0.0 fails to escape backslashes in event names used in a ClickHouse query for its Sankey chart. An authenticated project member can submit crafted event names that cause ClickHouse parse errors and disable the project's Sankey chart endpoint.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["clickhouse","openpanel","other","self-hosted"],"not_affected_if":["version-3.0.0-or-later"],"how_to_check":"- Check the OpenPanel version in the deployment, for example in `package.json` or the image tag; unknown if the sources do not give a command.\n- Confirm whether the `chart.sankey` procedure is reachable for your projects; unknown if the sources do not say how.","fix":"- Upgrade OpenPanel to `3.0.0` or later, per the NVD entry for CVE-2026-116815.","status":"open","published_at":"2026-10-27T00:17:15+00:00","first_seen_at":"2026-10-27T00:25:55+00:00","triaged_at":"2026-10-27T00:26:42+00:00","updated_at":"2026-10-27T00:26:42+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-27T00:26:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenPanel to `3.0.0` or later, per the NVD entry for CVE-2026-116815.","reach":"internet","title":"OpenPanel: backslashes in event names break Sankey chart queries","impact":"low","summary":"OpenPanel before 3.0.0 fails to escape backslashes in event names used in a ClickHouse query for its Sankey chart. An authenticated project member can submit crafted event names that cause ClickHouse parse errors and disable the project's Sankey chart endpoint.","category":"other","nicknames":[],"who_cares":["openpanel","self-hosted","clickhouse"],"confidence":0.6,"needs_auth":"yes","worst_case":"Project's Sankey chart endpoint is disabled by query errors","analyst_note":"Check the OpenPanel 3.0.0 release notes or the NVD entry to confirm the exact fix and whether any configuration workaround exists before 3.0.0.","how_to_check":"- Check the OpenPanel version in the deployment, for example in `package.json` or the image tag; unknown if the sources do not give a command.\n- Confirm whether the `chart.sankey` procedure is reachable for your projects; unknown if the sources do not say how.","needs_analyst":true,"not_affected_if":["version-3.0.0-or-later"],"who_is_affected":"Self-hosted or managed OpenPanel installs running a version before `3.0.0`. The flaw needs a logged-in project member who can read the project, and the impact is limited to the Sankey chart endpoint for that project. Teams on `3.0.0` or later can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000631,"input_tokens":3351,"output_tokens":592,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116815':12A,15A '-2026':11A,14A '3.0.0':24B,65C 'access':92C 'allow':74C 'attack':89C 'authent':42B,75C 'backslash':2A,28B,85C 'break':6A,79C 'caus':51B,103C 'chart':8A,40B,61B,113C 'chart.sankey':101C 'clickhous':16B,35B,52B,80C,104C 'contain':66C 'craft':47B,95C 'cve':10A,13A 'disabl':56B,108C 'endpoint':62B,114C 'error':54B,106C 'escap':27B,69C 'event':4A,30B,48B,87C,96C 'fail':25B 'host':21B 'improp':68C 'liter':82C 'member':44B,77C 'name':5A,31B,49B,88C,97C 'openpanel':1A,17B,22B,63C 'pars':53B,105C 'procedur':102C 'project':43B,58B,76C,110C 'queri':9A,36B 'read':91C 'sankey':7A,39B,60B,112C 'sankey.service.ts':72C 'self':20B 'self-host':19B 'string':81C 'submit':46B,94C 'suppli':84C 'use':32B 'valu':98C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed OpenPanel installs running a version before `3.0.0`. The flaw needs a logged-in project member who can read the project, and the impact is limited to the Sankey chart endpoint for that project. Teams on `3.0.0` or later can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116815","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116815","severity":null,"published_at":"2026-10-27T00:17:15+00:00","modified_at":"2026-10-27T00:17:15+00:00","first_seen_at":"2026-10-27T00:25:55+00:00","fetched_at":"2026-10-27T00:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}