CVE-2026-116807: fallo de gravedad alta en Openpanel-dev openpanel
OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7epss 0.3%
OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the project_id WHERE clause and read events from all projects.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
Openpanel-dev · openpanelCVEs relacionadas — Openpanel-dev openpanel
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-85610HIGHOpenPanel before 2.3.0 Remote Code Execution via chart formulasEPSS 0.7%CVE-2026-93985CRITICALOpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCEEPSS 0.7%CVE-2026-116817MEDIUMOpenPanel before 3.0.0 Missing Authentication on Worker Bull BoardEPSS 0.6%CVE-2026-85609MEDIUMOpenpanel before 2.3.0 SSRF via Site Checker EndpointEPSS 0.5%CVE-2026-116811HIGHOpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript TemplateEPSS 0.5%CVE-2026-88893HIGHOpenPanel through 2.3.0 Unauthenticated Share Lookup Information DisclosureEPSS 0.5%