OpenPanel EUVD-2026-110522

Finding 1 (credential exposure) requires that DATABASE_URL or CLICKHOUSE_URL be configured with user-info credentials or credential-like query parameters (password, sslpassword, user), that the code-migration command be run, and that the attacker can read the resulting standard-output 'Environment' log block. Finding 2 (reset-token exposure) requires the non-default condition that BOTH SMTP_HOST and RESEND_API_KEY are unset, an email flow (such as password reset) to be triggered, and attacker access to standard output logs. The overarching limiting factor for both is that the attacker must already have access to application, container, CI, or centralized log stores - there is no direct network-service trigger; exposure scales with how long and how widely those logs are retained.

This is a credible but moderate-priority issue rather than an emergency. The vendor CVSS 4.0 vector (7.1) scores AV:N/AC:L/PR:N/UI:P with VC:H, implying remote, unauthenticated confidentiality loss - but that characterization conflicts with the actual mechanism (CWE-532, sensitive data written to stdout/application logs). Real exploitation requires access to application, container, CI, or centralized-log stores, which is itself a form of privilege; PR:N therefore overstates openness and the UI:P marking (reflecting that an email/migration flow must be triggered) does not change the core dependency on log access - this discrepancy should be verified against the vendor advisory. Supporting signals point to measured urgency: EPSS is low at 0.28% (20th percentile), there is no CISA KEV listing, and no weaponized exploit is published, so widespread opportunistic exploitation is unlikely. The vuln.today decision label is 'this_week', consistent with a patched, high-severity disclosure flaw that warrants prompt remediation but not drop-everything response. The dominant risk is post-compromise or insider amplification: anyone who can already read logs can harvest full database connection credentials and live password-reset tokens, turning limited log visibility into database access or account takeover.

An attacker or insider with read access to OpenPanel's application, container, CI, or centralized logs inspects the migration startup 'Environment' banner and recovers the complete DATABASE_URL/CLICKHOUSE_URL including embedded credentials. In deployments where both SMTP_HOST and RESEND_API_KEY are unset, the same actor reads fallback email log output to capture password-reset URLs containing valid tokens, enabling account takeover. No weaponized exploit is required - the vendor advisory publishes exact reproduction steps.