OpenPanel CVE-2026-116808

Requires an authenticated account on a multi-tenant OpenPanel instance backed by a shared ClickHouse cluster - but this is a low bar because the advisory confirms registration and project creation are trivially self-service. The attacker must reach the profile.values tRPC endpoint and supply a property value that does NOT start with 'properties.' (the else branch interpolates the raw string directly into the SELECT expression position, where sqlstring.escape cannot protect it and no column allowlist is applied pre-patch). Limiting factors: exploitation is confined to deployments before 3.0.0 running shared multi-tenant ClickHouse storage, and requires authentication (though trivial to obtain); it does not work against the escaped 'properties.' key branch.

Signals are moderate and partly conflicting. The vendor's CVSS 4.0 vector scores 8.6 (AV:N/AC:L/PR:H/UI:N, VC:H/VI:H/VA:H), but two things temper it. First, PR:H overstates the barrier: the advisory states any user can trivially self-service register and create a project to obtain the required access, so real privilege cost is low (closer to PR:L). Second, VI:H/VA:H appears inflated - the described mechanism is a read-only ClickHouse SELECT injection enabling cross-tenant data disclosure, with no stated write or destruction capability, so integrity/availability impact is questionable and the true impact is confidentiality-dominated. Counterbalancing the high CVSS: EPSS is only 0.39% (32nd percentile, low), and the CVE is NOT in CISA KEV, indicating no confirmed mass or active exploitation. However, a complete step-by-step reproduction is published in the vendor's GHSA advisory, so exploitation is trivial for any authenticated user of a shared multi-tenant deployment. Net: this is a genuine, easy-to-exploit tenant-isolation breach in affected deployments (vuln.today priority 'this_week'), but not an emergency - the low EPSS and absence from KEV suggest it is not yet seeing widespread opportunistic exploitation.

An attacker self-registers on a shared OpenPanel instance, creates their own project to gain read access, then calls the profile.values endpoint with a crafted property parameter such as "email as values FROM profiles WHERE project_id = 'victimproj' -- " that injects its own FROM/WHERE and comments out the trailing project_id scope. The victim tenant's emails (or events/sessions, including PII, IPs, and revenue) are returned directly in the response values field (non-blind). A full working proof-of-concept with exact HTTP requests is published in the vendor's GHSA advisory.