---
id: "CVE-2026-116817"
kind: "vulnerability"
aliases: ["CVE-2026-116817"]
title: "OpenPanel: unauthenticated Bull Board dashboard exposes queue controls on worker port"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["openpanel", "package", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-27T00:17:15+00:00"
first_seen_at: "2026-10-27T00:25:55+00:00"
updated_at: "2026-10-27T00:26:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116817", "first_seen_at": "2026-10-27T00:25:55+00:00"}]
---

# OpenPanel: unauthenticated Bull Board dashboard exposes queue controls on worker port

OpenPanel versions before 3.0.0 serve the Bull Board queue dashboard on the worker HTTP port without authentication. An attacker can read queue data, metrics and datastore health, and add, retry or clean jobs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Upgrade OpenPanel to `3.0.0` or later.
- Until upgraded, block external access to the worker HTTP port.

## Timeline

- 2026-10-27T00:25:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116817

## From the sources

OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data, metrics, and datastore health.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_