OpenPanel EUVD-2026-110524

The attacker must be able to reach the worker HTTP port (WORKER_PORT, default 3000) where Bull Board is mounted at '/' with no auth middleware and DISABLE_BULLBOARD left at its default (off). This is NOT reachable in the shipped docker-compose.template.yml, which does not publish the worker port to the host - the concrete public path is the Coolify self-host template, which assigns SERVICE_FQDN_OPBULLBOARD and exposes the UI on a public hostname (the test instance bound *:9999 on all interfaces). No authentication, privileges, or user interaction are required once the port is reachable. Limiting factors: exposure is entirely deployment/proxy-dependent (loopback-bound or unproxied installs are not exposed); confidentiality of job payloads depends on queues actually being populated (event-queue bodies were empty on the test instance); and a successful privileged/crafted job add was not demonstrated, so integrity impact beyond retry/clean/metadata reads is unproven.

Signals converge on a genuine-but-moderate priority rather than an emergency. The vendor CVSS 4.0 base is 6.9 and the GHSA analysts independently rate CVSS 3.1 at 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) - network-reachable, no privileges, no user interaction, but deliberately capped at Low confidentiality and Low integrity because the analysts only demonstrated queue/metric reads and an add request that reached Redis without creating a job; they explicitly say not to raise to High without a successful privileged-job add or a dump of sensitive payloads. EPSS is low at 0.27% (19th percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a patch-this-cycle posture. The most important nuance the raw CVSS hides is exposure-dependence: the shipped docker-compose.template.yml does NOT publish the worker port to the host, so AV:N is only realized when an operator fronts the port with a proxy - the Coolify self-host template does exactly that by assigning SERVICE_FQDN_OPBULLBOARD, which is the concrete public path. A PoC walkthrough in the advisory confirms unauthenticated reads work; the mutating path is plausible but not proven. Net: real and worth patching this month, especially for Coolify deployments, but not a drop-everything issue given low EPSS, no KEV, and Low/Low impact.

An attacker who can reach the OpenPanel worker HTTP port - most realistically via a Coolify self-host that publishes SERVICE_FQDN_OPBULLBOARD on a public hostname - loads the Bull Board dashboard with no login and calls GET /api/queues to enumerate queues (group_events, sessions, cron, notification, etc.) and read job data, Prometheus /metrics, and /healthcheck datastore readiness. Because every queue returns readOnlyMode:false and allowRetries:true, the attacker can also invoke mutating endpoints to add, retry, or clean jobs. A public PoC reference exists in the advisory demonstrating the unauthenticated GET reads; it is not verified as working exploit code for a successful crafted job add (the demonstrated POST returned HTTP 500 from a Redis Lua script and created no job).