Openpanel

By the Year

In 2026 there have been 15 vulnerabilities in Openpanel with an average score of 7.2 out of ten. Last year, in 2025 Openpanel had 5 security vulnerabilities published. That is, 10 more vulnerabilities have already been reported in 2026 as compared to last year.

Recent Openpanel Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-93985	Sep 19, 2026	OpenPanel js-runtime Sandbox Escape via Webhook Template Validator OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.	Openpanel
CVE-2026-93984	Sep 19, 2026	OpenPanel Tracking API: Client Secret Hash Bypass Enables Revenue Injection OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.	Openpanel
CVE-2026-93983	Sep 19, 2026	OpenPanel ClickHouse SQL Injection via Unsanitized Property Keys OpenPanel through commit bad75bdd fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects.	Openpanel
CVE-2026-93982	Sep 19, 2026	OpenPanel logs unredacted MCP tokens from query parameters OpenPanel through commit bad75bdd writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and access project analytics.	Openpanel
CVE-2026-88893	Sep 10, 2026	OpenPanel Share Lookup Exposes Password Hashes via Access Control Bypass OpenPanel share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown dimensions for offline password cracking and business intelligence theft.	Openpanel
CVE-2026-88892	Sep 10, 2026	OpenPanel SSRF via Data Importer (all versions) OpenPanel is an analytics platform. In all versions (no patched release available at time of publication), the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard (apps/api/src/utils/safe-fetch.ts). In packages/importer/src/providers/umami.ts, parseRemoteFile calls fetch() on config.fileUrl, which is validated only by z.string().url(), so values such as http://127.0.0.1:9911/ or http://169.254.169.254/latest/meta-data/ are accepted; the shared createFileImportConfig factory gives the plausible provider the same field. An authenticated organization member including a default 'member' with no project_access rows, for whom the intended access-level check is skipped because getProjectAccess returns boolean true rather than a level object can therefore make the server connect to any address reachable from it. The resulting HTTP status and status text are persisted as Import.errorMessage and returned by import.get to the same user, providing a scanning oracle for internal hosts, ports and paths; if an internal response parses as Umami CSV, its rows are ingested as events and become readable in the attacker's analytics views.	Openpanel
CVE-2026-88891	Sep 10, 2026	OpenPanel Erroneous Read-Only Enforcement Enables Delete & Publish OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private analytics to public share links, and modify alerting rules by exploiting missing access level validation in mutation resolvers.	Openpanel
CVE-2026-88890	Sep 10, 2026	OpenPanel SQLi in Analytics Filter Builder via ClickHouse Injection OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inject arbitrary ClickHouse SQL to bypass project isolation and read other organizations' analytics data and profile PII via blind boolean oracle techniques.	Openpanel
CVE-2026-85615	Sep 04, 2026	Openpanel <2.3.0: IDOR in report.getLayouts & resetLayout Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId to read report layouts and configurations or delete dashboard grid arrangements across tenants.	Openpanel
CVE-2026-85614	Sep 04, 2026	OpenPanel <2.3.0 SSRF via /tools/site-checker (GET) OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue requests to internal services, localhost, and cloud metadata endpoints, reading internal HTTP response titles, headers, status codes, and SSL certificate information.	Openpanel