{"id":"CVE-2026-116818","kind":"vulnerability","aliases":["CVE-2026-116818"],"related":[],"title":"OpenPanel: unauthenticated SQL injection leaks other tenants' analytics data","description":"OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count oracles to read other tenants' events and profiles, and project members can similarly inject via the cohort.preview timeframe values.","summary":"OpenPanel before 3.0.0 lets a remote attacker inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which skips session and project-access checks. An attacker can use UNION or boolean count queries to read other tenants' events and profiles from the ClickHouse database.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["analytics","clickhouse","openpanel","package","self-hosted"],"not_affected_if":["no-internet-exposure","openpanel-3.0.0-or-later"],"how_to_check":"- Check the installed OpenPanel version; `unknown` if the sources do not say how to read it from a deployment.\n- Review whether the /live/visitors/:projectId WebSocket is reachable from the internet.","fix":"- Upgrade OpenPanel to `3.0.0` or later.\n- Until upgraded, restrict network access to the OpenPanel WebSocket endpoint.","status":"open","published_at":"2026-10-27T00:17:16+00:00","first_seen_at":"2026-10-27T00:25:55+00:00","triaged_at":"2026-10-27T00:26:15+00:00","updated_at":"2026-10-27T00:26:15+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T00:26:15Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenPanel to `3.0.0` or later.\n- Until upgraded, restrict network access to the OpenPanel WebSocket endpoint.","reach":"internet","title":"OpenPanel: unauthenticated SQL injection leaks other tenants' analytics data","impact":"medium","summary":"OpenPanel before 3.0.0 lets a remote attacker inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which skips session and project-access checks. An attacker can use UNION or boolean count queries to read other tenants' events and profiles from the ClickHouse database.","category":"package","nicknames":[],"who_cares":["openpanel","self-hosted","clickhouse","analytics"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads other tenants' events and profiles from ClickHouse.","analyst_note":"Confirm exact affected version range and whether the live WebSocket is enabled by default; check NVD entry for version details.","how_to_check":"- Check the installed OpenPanel version; `unknown` if the sources do not say how to read it from a deployment.\n- Review whether the /live/visitors/:projectId WebSocket is reachable from the internet.","needs_analyst":true,"not_affected_if":["openpanel-3.0.0-or-later","no-internet-exposure"],"who_is_affected":"Teams that self-host OpenPanel below 3.0.0 and expose its live visitors WebSocket to untrusted networks are exposed, since the endpoint skips authentication and project-access checks. Project members can also inject through cohort.preview timeframe values, so multi-tenant installs are most at risk. Teams running a current release or not exposing the endpoint can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000658,"input_tokens":3367,"output_tokens":642,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116818':12A,15A '-2026':11A,14A '/live/visitors':38B,92C '3.0.0':25B,71C 'access':47B,101C 'allow':80C 'analyt':8A,16B 'attack':29B,50B,82C,103C 'boolean':55B,108C 'check':48B,102C 'clickhous':17B,67B,75C 'cohort.preview':126C 'contain':72C 'count':56B,109C 'cve':10A,13A 'data':9A 'databas':68B 'event':62B,115C 'host':22B 'inject':4A,30B,77C,84C,123C 'lack':96C 'leak':5A 'let':26B 'member':120C 'openpanel':1A,18B,23B,69C 'oracl':110C 'packag':19B 'paramet':35B,89C 'profil':64B,117C 'project':46B,100C,119C 'project-access':45B,99C 'projectid':34B,39B,88C,93C 'queri':57B 'read':59B,112C 'remot':28B,81C 'self':21B 'self-host':20B 'session':43B,97C 'similar':122C 'skip':42B 'sql':3A,31B,76C,85C 'tenant':7A,61B,114C 'timefram':127C 'unauthent':2A,74C 'union':53B,106C 'use':52B,105C 'valu':128C 'via':124C 'vulner':78C 'websocket':40B,94C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host OpenPanel below 3.0.0 and expose its live visitors WebSocket to untrusted networks are exposed, since the endpoint skips authentication and project-access checks. Project members can also inject through cohort.preview timeframe values, so multi-tenant installs are most at risk. Teams running a current release or not exposing the endpoint can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116818","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116818","severity":null,"published_at":"2026-10-27T00:17:16+00:00","modified_at":"2026-10-27T00:17:16+00:00","first_seen_at":"2026-10-27T00:25:55+00:00","fetched_at":"2026-10-27T00:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}