Live › vulnerability › CVE-2026-116818
Go to dashboardOpenPanel before 3.0.0 lets a remote attacker inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which skips session and project-access checks. An attacker can use UNION or boolean count queries to read other tenants' events and profiles from the ClickHouse database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Teams that self-host OpenPanel below 3.0.0 and expose its live visitors WebSocket to untrusted networks are exposed, since the endpoint skips authentication and project-access checks. Project members can also inject through cohort.preview timeframe values, so multi-tenant installs are most at risk. Teams running a current release or not exposing the endpoint can skip it.
No product ranges from the sources yet.
unknown if the sources do not say how to read it from a deployment.3.0.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count oracles to read other tenants' events and profiles, and project members can similarly inject via the cohort.preview timeframe values.
This page as .md · .json · in your agent: get_signal("CVE-2026-116818")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.