OpenPanel: SQL injection in profile.values (CVE-2026-116808)
OpenPanel versions prior to 3.0.0 contain an SQL injection vulnerability in the profile.values endpoint that allows authenticated attackers to bypass cross-tenant controls and exfiltrate data from other projects.
CVE search metadata
CVE search record: CVE-2026-116808. Severity: high. CVSS: 7.2. KEV: no. Product: OpenPanel (< 3.0.0). Brief: OpenPanel: SQL injection in profile.values (CVE-2026-116808). Brief link: https://feed.craftedsignal.io/briefs/2026-10-openpanel-sql-injection/
CVE search record: CVE-2026-116819. Severity: high. CVSS: 8.5. KEV: no. Product: OpenPanel (< 3.0.0). Brief: OpenPanel: SQL injection in profile.values (CVE-2026-116808). Brief link: https://feed.craftedsignal.io/briefs/2026-10-openpanel-sql-injection/
Triage facts
Revision 1- Applicability
- OpenPanel (< 3.0.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 27, 01:51 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A2Roughly even chance
What's new
- 1. added coverage for OpenPanel (< 3.0.0) Oct 27, 01:52 via nvd
OpenPanel versions prior to 3.0.0 are affected by an SQL injection vulnerability. Authenticated users can manipulate the 'property' parameter within the 'profile.values' endpoint to inject arbitrary SQL expressions. This allows attackers to bypass multi-tenancy protections by including custom SELECT statements, FROM/WHERE clauses, and SQL comments to isolate and exfiltrate profiles, events, and session data belonging to other projects.
Impact
Successful exploitation allows for unauthorized cross-tenant data access, specifically the exfiltration of sensitive information including user profiles, event logs, and session data stored within the OpenPanel platform.
Recommendation
- Upgrade all instances of OpenPanel to version 3.0.0 or later to remediate CVE-2026-116808.
- Implement request logging on the 'profile.values' endpoint to audit 'property' parameter values for potential SQL injection characters such as comment sequences (--) or SQL keywords (SELECT, UNION, FROM).
Immediate actions
Upgrade OpenPanel to version 3.0.0 or later.
Upgrade OpenPanel to version 3.0.0 or later
Threat Hunt
Inspect application logs for the profile.values endpoint containing SQL injection patterns in the property parameter.
Data: Application server request logs
Identify excessive or repeated requests to the notification.rules tRPC query endpoint from non-administrative project users
Data: Web server access logs or tRPC request logs
Mitigations
Upgrade OpenPanel to 3.0.0.
CVE-2026-116808
Apply patch to version 3.0.0
CVE-2026-116819