{"id":"CVE-2026-116817","kind":"vulnerability","aliases":["CVE-2026-116817"],"related":[],"title":"OpenPanel: unauthenticated Bull Board dashboard exposes queue controls on worker port","description":"OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data, metrics, and datastore health.","summary":"OpenPanel versions before 3.0.0 serve the Bull Board queue dashboard on the worker HTTP port without authentication. An attacker can read queue data, metrics and datastore health, and add, retry or clean jobs.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["openpanel","package","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":"- unknown","fix":"- Upgrade OpenPanel to `3.0.0` or later.\n- Until upgraded, block external access to the worker HTTP port.","status":"open","published_at":"2026-10-27T00:17:15+00:00","first_seen_at":"2026-10-27T00:25:55+00:00","triaged_at":"2026-10-27T00:26:29+00:00","updated_at":"2026-10-27T00:26:29+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T00:26:29Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenPanel to `3.0.0` or later.\n- Until upgraded, block external access to the worker HTTP port.","reach":"network","title":"OpenPanel: unauthenticated Bull Board dashboard exposes queue controls on worker port","impact":"medium","summary":"OpenPanel versions before 3.0.0 serve the Bull Board queue dashboard on the worker HTTP port without authentication. An attacker can read queue data, metrics and datastore health, and add, retry or clean jobs.","category":"package","nicknames":[],"who_cares":["openpanel","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker manipulates background job queues and reads queue data","analyst_note":"Check the NVD entry and the OpenPanel 3.0.0 release notes for the fixed behaviour and whether the worker port is exposed by default.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"who_is_affected":"Self-hosted OpenPanel installations running a version before `3.0.0` where the worker HTTP port is reachable by an attacker. The sources do not say whether managed hosting is affected or which network exposure is required beyond reaching that port.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000572,"input_tokens":3335,"output_tokens":478,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116817':14A,17A '-2026':13A,16A '/api/queues':83C '3.0.0':26B,58C 'access':69C 'add':51B,91C 'allow':65C 'api':89C 'attack':41B,67C,80C 'authent':39B,62C 'board':4A,30B,72C,88C 'bull':3A,29B,71C,87C 'call':85C 'clean':54B,94C 'contain':59C 'control':8A 'cve':12A,15A 'dashboard':5A,32B,73C 'data':45B,99C 'datastor':48B,102C 'expos':6A 'health':49B,103C 'host':22B 'http':36B,78C 'job':55B,95C 'metric':46B,100C 'miss':61C 'mutat':86C 'openpanel':1A,18B,23B,56C 'packag':19B 'port':11A,37B,79C 'queri':82C 'queue':7A,31B,44B,98C 'read':43B,97C 'retri':52B,92C 'self':21B 'self-host':20B 'serv':27B,74C 'unauthent':2A,66C 'version':24B 'vulner':63C 'without':38B 'worker':10A,35B,77C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted OpenPanel installations running a version before `3.0.0` where the worker HTTP port is reachable by an attacker. The sources do not say whether managed hosting is affected or which network exposure is required beyond reaching that port.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116817","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116817","severity":null,"published_at":"2026-10-27T00:17:15+00:00","modified_at":"2026-10-27T00:17:15+00:00","first_seen_at":"2026-10-27T00:25:55+00:00","fetched_at":"2026-10-27T00:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}