OpenPanel CVE-2026-116811

The attacker must be an authenticated OpenPanel project member with write or admin access level (WRITE_LEVELS) on at least one project - this is not remote-unauthenticated. The deployment must expose the webhook integration feature used with mode:'javascript' and a javascriptTemplate, which is present in every build since commit 286f8e16 (2026-01-23); no other non-default configuration is needed. Execution is triggered by attaching a notification rule to the integration and then having one matching event ingested through the public /track endpoint, at which point the worker evaluates and runs the template. The key limiting factor is the write-access precondition (PR:L), which confines realistic risk to insider threats and multi-tenant installs that grant project write access to non-fully-trusted users; the escape itself requires no user interaction and no special timing.

This is best characterized as an authenticated privilege-to-RCE escalation rather than a drive-by remote flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 8.7) confirms network reach, low complexity, no user interaction and no attack requirements, but PR:L means the attacker must already be an authenticated project member with write (or admin) access - so this is an insider or multi-tenant threat, not an anonymous internet attack. The payoff is high: full code execution in the worker process that holds the database, ClickHouse, Redis and third-party integration credentials (hence VC/VI/VA:H). Signals are only mildly conflicting: a complete, reproduced proof-of-concept is published in the vendor's GHSA advisory (demonstrated RCE with verbatim output), yet EPSS is low at 0.49% (42nd percentile) and the CVE is NOT in CISA KEV, indicating no evidence of widespread active exploitation - consistent with a niche, self-hosted product and a precondition of write access. The vuln.today decision label is 'this_week', which should drive the urgency: this is a genuine priority for any operator who grants project write access to semi-trusted users or runs OpenPanel multi-tenant, but materially lower risk for a single-tenant deployment where every project member is already fully trusted. The low EPSS despite a working PoC reflects limited deployment footprint plus the authentication precondition, not a weak vulnerability.

A user holding write access to a single OpenPanel project configures a webhook integration in JavaScript mode and submits a transform template that reads payload.constructor.constructor into a local variable to recover the real Function constructor, then calls it to run arbitrary code; a full working proof-of-concept is published in the vendor's GHSA advisory with reproduced command output. The template passes the AST allowlist validator at save time, and when any matching tracked event is ingested the worker compiles and runs it, executing attacker code with the worker's privileges and access to its stored credentials. Attack complexity is low and no user interaction is required, but the attacker must already be an authenticated project member.