---
id: "CVE-2026-116815"
kind: "vulnerability"
aliases: ["CVE-2026-116815"]
title: "OpenPanel: backslashes in event names break Sankey chart queries"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["clickhouse", "openpanel", "other", "self-hosted"]
not_affected_if: ["version-3.0.0-or-later"]
published_at: "2026-10-27T00:17:15+00:00"
first_seen_at: "2026-10-27T00:25:55+00:00"
updated_at: "2026-10-27T00:26:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116815", "first_seen_at": "2026-10-27T00:25:55+00:00"}]
---

# OpenPanel: backslashes in event names break Sankey chart queries

OpenPanel before 3.0.0 fails to escape backslashes in event names used in a ClickHouse query for its Sankey chart. An authenticated project member can submit crafted event names that cause ClickHouse parse errors and disable the project's Sankey chart endpoint.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenPanel version in the deployment, for example in `package.json` or the image tag; unknown if the sources do not give a command.
- Confirm whether the `chart.sankey` procedure is reachable for your projects; unknown if the sources do not say how.

## Fix

- Upgrade OpenPanel to `3.0.0` or later, per the NVD entry for CVE-2026-116815.

## Timeline

- 2026-10-27T00:25:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116815

## From the sources

OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can submit crafted events[].name values to the chart.sankey procedure, causing ClickHouse parse errors that disable the project's Sankey chart endpoint.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_