Openpanel
Monthly
Read-level project members in OpenPanel before 3.0.0 can retrieve plaintext integration secrets - Slack bot tokens, incoming-webhook URLs and webhook authorization headers - through the notification.rules tRPC query, which eager-loads integration rows and spreads them into the response without applying the redactIntegration step that integration.get and integration.list enforce. The flaw is access-gated: the attacker needs an existing authenticated account with bare project membership (the lowest role, which cannot create or edit integrations) on a project where a write/admin user has attached at least one integration to a notification rule, and a single query call with no user interaction then exposes those credentials for use against external systems. EPSS is 0.30% (23rd percentile) with no CISA KEV listing, and the vendor advisory contains a benign manual proof-of-concept walkthrough; it is a public PoC reference that is not verified as working exploit code.
Unauthenticated ClickHouse SQL injection in OpenPanel before 3.0.0 lets remote attackers read other tenants' analytics data by injecting SQL through the projectId path segment of the /live/visitors/:projectId WebSocket, a handler that skips the session and project-access checks its sibling endpoints enforce. A second, authenticated variant lets any project member inject through the unescaped timeframe start/end values in cohort.preview; in both cases the payload reaches the shared ClickHouse events table that is isolated only by a WHERE project_id predicate, so extraction is cross-tenant. Exploitation requires no credentials for the primary vector and no special configuration, though data recovery is inferential (UNION or boolean/count oracles against a uniq(profile_id) count) rather than a bulk dump; the vendor advisory includes a benign demonstration query, but it is not verified as working exploit code, the vendor has released 3.0.0 as a fix, CISA KEV does not list the issue, SSVC exploitation is 'none', and EPSS is low at 0.43% (37th percentile).
OpenPanel before 3.0.0 leaks secrets into standard-output logs through two separate code paths, allowing anyone who can read application, container, CI or centralized logs to recover sensitive data. Database migration startup banners print the full DATABASE_URL and CLICKHOUSE_URL including user-info credentials and credential-like query parameters, and the email fallback path used when both SMTP_HOST and RESEND_API_KEY are unset serializes the recipient address, subject and full template data - which for the password-reset flow includes the reset-token URL. Exploitation is not remote against the service itself: it requires pre-existing read access to log stores plus, in the migration case, that the code-migration command was run, or, in the email case, the non-default double-unset provider configuration and a triggered email flow; no public exploit code is identified at time of analysis and EPSS is low (0.28%, 20th percentile), consistent with a moderate-priority information exposure rather than an emergency.
SQL injection in OpenPanel's conversion analytics query allows project-read members and share-link holders to read other tenants' ClickHouse analytics data. Before version 3.0.0, ConversionService.getConversion interpolates series event names and startDate/endDate values raw inside single quotes, so a payload such as x' OR 1=1 neutralizes the project_id tenant scoping; the projectId value itself is passed through sqlstring.escape, so the omission is confined to the event-name and date fields. Exploitation requires an authenticated low-privilege actor (CVSS 4.0 PR:L) or a valid share link, and cross-tenant impact depends on a multi-tenant deployment in which the ClickHouse reader credential can read all rows. The advisory includes a PoC payload description that is not verified as working exploit code; SSVC records exploitation as none and EPSS is 0.23% (14th percentile), so this is a real but moderate-priority exposure focused purely on confidentiality.
SQL injection in OpenPanel's cohort preview query lets any user holding project-read access on any project read ClickHouse data belonging to other tenants; this is a genuine but access-gated data-disclosure issue rather than a drop-everything emergency. The flaw is confined to the ClickHouse analytics backend (the default) in multi-tenant deployments, requires a valid low-privileged account (authenticated, project READ only, no write or admin role), and affects OpenPanel versions before 3.0.0. Exploitation permits read-only cross-tenant disclosure with no integrity or availability impact, there is no CISA KEV listing, EPSS is low at 0.23% (14th percentile), and a public PoC reference exists in the vendor advisory (a cohort.preview payload using operator isNotNull with an empty value array); it is not verified as working exploit code. A vendor patch is available, and the source-level fix is to apply the PROFILE_COLUMNS allowlist to profileColumnAccess.
Sandbox escape in OpenPanel's JavaScript webhook-template runtime (packages/js-runtime) allows an authenticated project member holding write or admin access on at least one project to execute arbitrary commands inside the worker process, which holds the database, ClickHouse, Redis and third-party integration credentials. The AST allowlist in validate() only inspects member-expression call targets and assignment left-hand sides, so a template can copy payload.constructor.constructor into a local and invoke it as a plain identifier, and execute() then compiled that template with new Function() in the worker itself. Every build since the JavaScript template feature landed in commit 286f8e16 (2026-01-23) through 61a92453 (2026-09-18) is affected; the trigger requires the attacker to attach a notification rule to the malicious webhook integration and have one matching event ingested via the public /track endpoint, with no user interaction and no special timing. No CISA KEV entry exists and EPSS is modest (0.49%, 42nd percentile), consistent with a flaw gated behind project write access rather than a drive-by remote attack; the vendor advisory nonetheless publishes a working proof-of-concept harness that demonstrates validator bypass and host command execution.
Cross-tenant data exposure in OpenPanel before 3.0.0 lets any authenticated user read other projects' profiles, events and sessions out of a shared ClickHouse cluster by injecting a SELECT expression into the 'property' parameter of the profile.values tRPC endpoint. The injected expression carries its own FROM/WHERE clause and comments out the trailing project_id scope, and results are returned directly in the response 'values' field, so exfiltration is non-blind (emails, IPs, session and revenue data from any tenant). Registration and project creation are self-service, so the authentication prerequisite is trivial; a reproducible proof-of-concept with full request steps is published in the vendor's GitHub advisory, but there is no KEV listing and no confirmed active exploitation, and EPSS is low at 0.39% (32nd percentile) with a vuln.today decision of this_week. The vendor CVSS 4.0 base score is 8.6, while our assessment treats it as a scope-changed confidentiality-only issue.
OpenPanel deployments before 3.0.0 are exposed to SQL injection through the tRPC `event.events` query, which splices an unconstrained `profile.*` filter name directly into the profiles-JOIN subquery, letting any authenticated user with read access to a single project comment out the `WHERE project_id` scoping and read events (path, country, city, profile_id, revenue) from every other tenant. The same unsanitized JOIN construction also appears in `getEventsCount` and the funnel service, so the exposure is not limited to a single endpoint. A public PoC reference with reproduction steps accompanies the GitHub advisory (GHSA-pc3q-gw7f-p2x2); it is not verified as working exploit code and there is no KEV entry. EPSS is low at 0.27% (19th percentile), and the vendor fixed the flaw with an allowlist in the 3.0.0 release.
Code execution in OpenPanel's js-runtime component lets an authenticated user who holds project write access escape the JavaScript webhook template sandbox and run arbitrary code inside the worker process. The template validator fails to block computed (bracket-notation) member access that traverses a constructor chain to the Function constructor, so merely creating or editing a webhook template is sufficient - no user interaction is required (UI:N). No public exploit code has been identified at time of analysis, and no CISA KEV or EPSS signal was supplied, but our independent assessment rates this a genuine high-priority issue, with CVSS 3.1 AV:N/PR:L/UI:N/S:C/C:H/I:H/A:H (scope change to the host system and full confidentiality, integrity and availability impact).
Unauthenticated information disclosure in OpenPanel (openpanel-dev/openpanel) exposes argon2id password hashes and full report configurations to any caller possessing a share link. The share lookup API endpoint fails to enforce access controls, returning sensitive account credentials and proprietary business intelligence data - event names, filters, and breakdown dimensions - without validating the caller's identity or authorization. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vulnerability is trivially exploitable by anyone who obtains a share link.
OpenPanel's server-side mutation resolvers fail to enforce project access levels, allowing read-only project members to execute 26 of 29 write operations that should be restricted to higher-privileged roles. Affected actions include deleting reports and dashboards, scheduling entire projects for deletion, publishing private analytics to public share links, and modifying alerting rules - all achievable by any user with the lowest valid project membership tier. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; organizations should consult GitHub Security Advisory GHSA-f9rx-pxgw-c6rg for patch details.
Cross-tenant SQL injection in OpenPanel's analytics filter builder allows authenticated attackers with project-scoped read credentials to exfiltrate other organizations' analytics data and profile PII. Unvalidated `profile.*` filter column identifiers are interpolated directly into ClickHouse WHERE clauses, enabling blind boolean oracle attacks that bypass project isolation boundaries. No public exploit code has been identified at time of analysis, but the low authentication bar and confirmed cross-tenant scope change make this a genuine priority for any multi-tenant OpenPanel deployment.
Server-side request forgery in OpenPanel before 2.3.0 lets unauthenticated remote attackers coerce the panel server into issuing arbitrary outbound requests via the GET /tools/site-checker endpoint, which accepts a fully client-controlled URL with no private-IP filtering or DNS-rebinding defenses. Attackers can reach localhost, internal-only services, and cloud metadata endpoints, harvesting HTTP response titles, headers, status codes, and SSL certificate details. Reported by VulnCheck with a fix in 2.3.0; no public exploit identified at time of analysis, though the endpoint is trivially reachable.
Unauthenticated XSS in OpenPanel before 2.3.0 allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a malicious SVG URL to the unprotected favicon proxy endpoint GET /misc/favicon. Because the SVG is served from the OpenPanel API origin, embedded scripts inherit same-origin context, enabling the attacker's code to issue credentialed requests against authenticated admin API endpoints on the victim's behalf. No public exploit code has been identified at time of analysis, but the attack requires only standard web delivery and a logged-in admin victim.
Unauthenticated SSRF in OpenPanel before 2.3.0 exposes two utility endpoints - /misc/favicon and /misc/og - that blindly fetch attacker-supplied URLs without adequate validation. Any remote, unauthenticated attacker can direct the OpenPanel server to query internal network hosts or cloud metadata services (such as AWS IMDSv1 at 169.254.169.254), with response bodies returned verbatim to the attacker, enabling direct theft of cloud IAM credentials and systematic enumeration of internal services. The vendor has released a fix in version 2.3.0 per the GitHub Security Advisory GHSA-2hff-m67f-2w2w; no public exploit code or CISA KEV listing is identified at time of analysis.
Authenticated remote code execution in OpenPanel before 2.3.0 allows any project member with read access to escape the mathjs formula sandbox by traversing matrix object prototypes to recover the native JavaScript Function constructor. Once recovered, the constructor enables loading Node.js core modules such as child_process, granting full OS command execution with the privileges of the API process. The vulnerability crosses organization authorization boundaries, meaning a low-privileged member of one project can pivot to affect all organizations co-hosted on the same OpenPanel instance. No public exploit has been identified at time of analysis.
Unauthenticated access to the Bull Board queue dashboard in OpenPanel self-hosted deployments before 3.0.0 exposes queue administration on the worker HTTP port: anyone who can reach that port can load the dashboard, list every BullMQ queue (with readOnlyMode:false and allowRetries:true), read queue data, Prometheus metrics and Redis/PostgreSQL/ClickHouse health, and call mutating Bull Board endpoints such as add, retry and clean. Exposure is deployment-dependent - the default docker-compose.template.yml does not publish the worker port, but the shipped Coolify template assigns SERVICE_FQDN_OPBULLBOARD to the worker and thereby publishes the UI on a public hostname, and the reporter's test instance bound the port on all interfaces. The vendor advisory includes PoC requests demonstrating HTTP 200 on GET / and GET /api/queues with no 401, but a crafted privileged job add was not demonstrated; EPSS is 0.27% (19th percentile) and there is no CISA KEV entry, and the vendor fixed the issue in 3.0.0.
Improper escaping in OpenPanel's sankey.service.ts lets any authenticated member of a project - read access alone is sufficient - supply an events[].name value containing a backslash to the chart.sankey procedure and break out of the ClickHouse string literal, producing a parse error that takes the project's Sankey chart endpoint offline. The flaw affects OpenPanel releases before 3.0.0 and is a self-contained availability issue: only the one chart feature the attacker can already read is disrupted, with no confidentiality or integrity impact and no cross-tenant reach. The reporter could break the literal but not convert it into a working injection, so the practical effect is denial of a single feature; EPSS is only 0.23% (14th percentile), the issue is not in CISA KEV, and no confirmed exploitation has been reported. Authentication requirements are confirmed as low-privileged (PR:L in the CVSS vector). Vendor-released patch: 3.0.0.
Unauthenticated cross-tenant disclosure in OpenPanel before 3.0.0 allows any remote attacker to read other tenants' project annotations - release notes, deploy markers and internal event notes - by calling the public reference.getChartReferences tRPC procedure with a guessed slug-based projectId. The handler never reads the session and performs no project-access or share-token check, so it returns title, description and date rows for any project whose ID the attacker can guess; impact is confidentiality-only (CVSS 6.9, assessed as CVSS:3.1 C:L with no integrity or availability effect). EPSS is 0.25% (16th percentile) and there is no CISA KEV listing, but the vendor advisory documents a public proof-of-concept request and the issue is fixed in 3.0.0.
Unauthenticated bot-event disclosure in OpenPanel (all versions before 3.0.0) lets anyone POST to the event.bots tRPC procedure with only a projectId and receive bot-event rows - name, type, path and created_at - from projects whose overview share is private or password-protected. The procedure's anonymous branch only checks that a shareOverview row exists and never reads the share's public flag or password, so a share that was created and later toggled off (the share router has no delete path, so the row persists) still leaks, and the exposed path field can reveal internal routes. Impact is confidentiality-only against projects that have such a share row; EPSS is low at 0.21% (11th percentile), SSVC records exploitation as none, a public PoC request is documented in the advisory but is not verified as working exploit code, and the vendor has released a fix in 3.0.0.
Missing authorization in OpenPanel's onboarding.project tRPC mutation lets any authenticated organization member - including a read-only one - create unlimited projects and mint plaintext write-type ingestion credentials inside that organization, bypassing the admin-only policy that the sibling procedures project.create and client.create enforce. All releases before 3.0.0 are affected (2.3.0 confirmed vulnerable), and the minted write-type secret cannot read existing data or manage resources, so impact is bounded to injecting fake analytics events, poisoning business metrics and consuming the organization's usage budget. EPSS is low (0.24%, 15th percentile), there is no CISA KEV entry, and the upstream GHSA advisory publishes a working PoC request (a single tRPC call over the dashboard httpLink with a non-admin member session cookie).
Read-level project members in OpenPanel before 3.0.0 can retrieve the argon2id hashes of every ingestion credential in a project by calling the client.list tRPC query, which returns full Prisma Client rows because the findMany call carries neither a select nor an omit clause. The vendor advisory includes a PoC reference request showing the expected response shape; it is not verified as working exploit code, there is no CISA KEV entry, and EPSS is 0.22% (12th percentile). Realistic risk is limited: the underlying secrets are roughly 80-bit random values and the stored hashes use argon2id (m=19456, t=2, p=1), so the leak chiefly enables offline confirmation of secrets obtained elsewhere without using the credential against the live API and without leaving an audit trail.
Authentication bypass in the OpenPanel tracking API allows unauthenticated remote attackers to inject forged revenue metrics and evade bot-detection filters by supplying arbitrary dummy secrets-only a public client ID, intentionally exposed in the client-side tracking snippet, is required. Affected versions extend through commit bad75bddc74d12d36cfb843f4531d3b830a8d994; the flaw is a moderate-severity integrity issue (CVSS 3.1 I:L) with no public exploit identified at time of analysis.
Authenticated SQL injection in OpenPanel's ClickHouse-backed metrics and filter functionality lets a user with access to at least one project inject boolean SQL terms through crafted property/filter keys, bypassing project isolation to read analytics metrics belonging to other projects. All deployments of OpenPanel up through commit bad75bdd that expose the ClickHouse metrics/filter feature are affected; the CVSS 4.0 base score is 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L), reflecting a bounded, read-only, cross-tenant confidentiality impact rather than code execution or data tampering. At the time of analysis there is no indication of confirmed active exploitation (CISA KEV) and no public exploit code identified; the primary risk drivers are the authentication requirement (PR:L) and the fact that only metrics data can be read, not modified.
Credential exposure in OpenPanel's Model Context Protocol (MCP) integration causes MCP authentication tokens supplied as URL query parameters to be written verbatim into plaintext application logs, letting anyone who can read application stdout, container/pod logs, or a centralized logging/SIEM store harvest base64-encoded credentials and replay MCP requests for read access to project analytics. The issue is gated by prior read access to the log data (CVSS 4.0 vector AV:L/PR:L; the independent assessment scores it low at CVSS 3.1 with only low confidentiality impact and no integrity or availability effect), so it is a real but low-priority defect rather than a remote unauthenticated path. No public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) status is indicated in the provided data.
Server-side request forgery in OpenPanel's data importer allows authenticated organization members to probe internal network hosts, services, and cloud metadata endpoints. The flaw exists because `parseRemoteFile` in `packages/importer/src/providers/umami.ts` calls plain `fetch()` on a caller-supplied `config.fileUrl` validated only by Zod's `z.string().url()` format check, entirely bypassing the project's own SSRF guard at `apps/api/src/utils/safe-fetch.ts`; the shared `createFileImportConfig` factory exposes the same unguarded field. An additional access-control bug means even a default 'member' with no project_access rows can exploit this path, because `getProjectAccess` returns boolean `true` instead of a level object, causing the intended access-level check to be skipped. No patched release was available at time of publication, and no public exploit has been identified at time of analysis.
Cross-tenant insecure direct object reference in Openpanel before 2.3.0 allows authenticated users to read or reset other tenants' dashboard layouts by supplying arbitrary dashboardId values in tRPC API calls. The report.getLayouts and report.resetLayout tRPC procedures accept a caller-supplied dashboardId without verifying it belongs to the authenticated user's own projectId, enabling horizontal privilege escalation across tenant boundaries. No public exploit code has been identified, and no active exploitation is confirmed, but the flaw is trivially exploitable by any authenticated user on a shared Openpanel instance.
Cross-tenant broken object level authorization (BOLA) in OpenPanel before 2.3.0 exposes confidential report definitions and enables permanent destruction of dashboard layouts across tenant boundaries. The `report.getLayouts` and `report.resetLayout` tRPC procedures accept caller-supplied `projectId` values without verifying tenant ownership, allowing any authenticated user to target a victim organization's dashboards by supplying guessable `dashboardId` values. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated full-read SSRF in Openpanel before 2.3.0 enables remote attackers to issue arbitrary server-side HTTP requests through the /tools/site-checker endpoint, with no authentication, IP allowlisting, or SSRF mitigation in place. The endpoint's url query parameter is passed directly to fetchWithRedirects() in apps/api/src/controllers/tools.controller.ts, allowing attackers to reach cloud instance metadata services (e.g., AWS IMDS at 169.254.169.254), enumerate internal ports, and retrieve response content including status codes, page sizes, and parsed HTML metadata. A secondary leakage path via getIPInfo() exfiltrates internal IP addresses to a third-party service, exposing network topology data beyond the attacker's direct channel. No public exploit code has been identified at time of analysis.
Cross Site Request Forgery vulnerability in Open Panel OpenAdmin v.0.3.4 allows a remote attacker to escalate privileges via the Change Root Password function. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
OpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue found in the Copy and View functions in the File Manager component of OpenPanel v0.3.4 allows attackers to execute a directory traversal via a crafted HTTP request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in OpenPanel v0.3.4 to v0.2.1 allows attackers to execute a directory traversal in File Actions of File Manager. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Read-level project members in OpenPanel before 3.0.0 can retrieve plaintext integration secrets - Slack bot tokens, incoming-webhook URLs and webhook authorization headers - through the notification.rules tRPC query, which eager-loads integration rows and spreads them into the response without applying the redactIntegration step that integration.get and integration.list enforce. The flaw is access-gated: the attacker needs an existing authenticated account with bare project membership (the lowest role, which cannot create or edit integrations) on a project where a write/admin user has attached at least one integration to a notification rule, and a single query call with no user interaction then exposes those credentials for use against external systems. EPSS is 0.30% (23rd percentile) with no CISA KEV listing, and the vendor advisory contains a benign manual proof-of-concept walkthrough; it is a public PoC reference that is not verified as working exploit code.
Unauthenticated ClickHouse SQL injection in OpenPanel before 3.0.0 lets remote attackers read other tenants' analytics data by injecting SQL through the projectId path segment of the /live/visitors/:projectId WebSocket, a handler that skips the session and project-access checks its sibling endpoints enforce. A second, authenticated variant lets any project member inject through the unescaped timeframe start/end values in cohort.preview; in both cases the payload reaches the shared ClickHouse events table that is isolated only by a WHERE project_id predicate, so extraction is cross-tenant. Exploitation requires no credentials for the primary vector and no special configuration, though data recovery is inferential (UNION or boolean/count oracles against a uniq(profile_id) count) rather than a bulk dump; the vendor advisory includes a benign demonstration query, but it is not verified as working exploit code, the vendor has released 3.0.0 as a fix, CISA KEV does not list the issue, SSVC exploitation is 'none', and EPSS is low at 0.43% (37th percentile).
OpenPanel before 3.0.0 leaks secrets into standard-output logs through two separate code paths, allowing anyone who can read application, container, CI or centralized logs to recover sensitive data. Database migration startup banners print the full DATABASE_URL and CLICKHOUSE_URL including user-info credentials and credential-like query parameters, and the email fallback path used when both SMTP_HOST and RESEND_API_KEY are unset serializes the recipient address, subject and full template data - which for the password-reset flow includes the reset-token URL. Exploitation is not remote against the service itself: it requires pre-existing read access to log stores plus, in the migration case, that the code-migration command was run, or, in the email case, the non-default double-unset provider configuration and a triggered email flow; no public exploit code is identified at time of analysis and EPSS is low (0.28%, 20th percentile), consistent with a moderate-priority information exposure rather than an emergency.
SQL injection in OpenPanel's conversion analytics query allows project-read members and share-link holders to read other tenants' ClickHouse analytics data. Before version 3.0.0, ConversionService.getConversion interpolates series event names and startDate/endDate values raw inside single quotes, so a payload such as x' OR 1=1 neutralizes the project_id tenant scoping; the projectId value itself is passed through sqlstring.escape, so the omission is confined to the event-name and date fields. Exploitation requires an authenticated low-privilege actor (CVSS 4.0 PR:L) or a valid share link, and cross-tenant impact depends on a multi-tenant deployment in which the ClickHouse reader credential can read all rows. The advisory includes a PoC payload description that is not verified as working exploit code; SSVC records exploitation as none and EPSS is 0.23% (14th percentile), so this is a real but moderate-priority exposure focused purely on confidentiality.
SQL injection in OpenPanel's cohort preview query lets any user holding project-read access on any project read ClickHouse data belonging to other tenants; this is a genuine but access-gated data-disclosure issue rather than a drop-everything emergency. The flaw is confined to the ClickHouse analytics backend (the default) in multi-tenant deployments, requires a valid low-privileged account (authenticated, project READ only, no write or admin role), and affects OpenPanel versions before 3.0.0. Exploitation permits read-only cross-tenant disclosure with no integrity or availability impact, there is no CISA KEV listing, EPSS is low at 0.23% (14th percentile), and a public PoC reference exists in the vendor advisory (a cohort.preview payload using operator isNotNull with an empty value array); it is not verified as working exploit code. A vendor patch is available, and the source-level fix is to apply the PROFILE_COLUMNS allowlist to profileColumnAccess.
Sandbox escape in OpenPanel's JavaScript webhook-template runtime (packages/js-runtime) allows an authenticated project member holding write or admin access on at least one project to execute arbitrary commands inside the worker process, which holds the database, ClickHouse, Redis and third-party integration credentials. The AST allowlist in validate() only inspects member-expression call targets and assignment left-hand sides, so a template can copy payload.constructor.constructor into a local and invoke it as a plain identifier, and execute() then compiled that template with new Function() in the worker itself. Every build since the JavaScript template feature landed in commit 286f8e16 (2026-01-23) through 61a92453 (2026-09-18) is affected; the trigger requires the attacker to attach a notification rule to the malicious webhook integration and have one matching event ingested via the public /track endpoint, with no user interaction and no special timing. No CISA KEV entry exists and EPSS is modest (0.49%, 42nd percentile), consistent with a flaw gated behind project write access rather than a drive-by remote attack; the vendor advisory nonetheless publishes a working proof-of-concept harness that demonstrates validator bypass and host command execution.
Cross-tenant data exposure in OpenPanel before 3.0.0 lets any authenticated user read other projects' profiles, events and sessions out of a shared ClickHouse cluster by injecting a SELECT expression into the 'property' parameter of the profile.values tRPC endpoint. The injected expression carries its own FROM/WHERE clause and comments out the trailing project_id scope, and results are returned directly in the response 'values' field, so exfiltration is non-blind (emails, IPs, session and revenue data from any tenant). Registration and project creation are self-service, so the authentication prerequisite is trivial; a reproducible proof-of-concept with full request steps is published in the vendor's GitHub advisory, but there is no KEV listing and no confirmed active exploitation, and EPSS is low at 0.39% (32nd percentile) with a vuln.today decision of this_week. The vendor CVSS 4.0 base score is 8.6, while our assessment treats it as a scope-changed confidentiality-only issue.
OpenPanel deployments before 3.0.0 are exposed to SQL injection through the tRPC `event.events` query, which splices an unconstrained `profile.*` filter name directly into the profiles-JOIN subquery, letting any authenticated user with read access to a single project comment out the `WHERE project_id` scoping and read events (path, country, city, profile_id, revenue) from every other tenant. The same unsanitized JOIN construction also appears in `getEventsCount` and the funnel service, so the exposure is not limited to a single endpoint. A public PoC reference with reproduction steps accompanies the GitHub advisory (GHSA-pc3q-gw7f-p2x2); it is not verified as working exploit code and there is no KEV entry. EPSS is low at 0.27% (19th percentile), and the vendor fixed the flaw with an allowlist in the 3.0.0 release.
Code execution in OpenPanel's js-runtime component lets an authenticated user who holds project write access escape the JavaScript webhook template sandbox and run arbitrary code inside the worker process. The template validator fails to block computed (bracket-notation) member access that traverses a constructor chain to the Function constructor, so merely creating or editing a webhook template is sufficient - no user interaction is required (UI:N). No public exploit code has been identified at time of analysis, and no CISA KEV or EPSS signal was supplied, but our independent assessment rates this a genuine high-priority issue, with CVSS 3.1 AV:N/PR:L/UI:N/S:C/C:H/I:H/A:H (scope change to the host system and full confidentiality, integrity and availability impact).
Unauthenticated information disclosure in OpenPanel (openpanel-dev/openpanel) exposes argon2id password hashes and full report configurations to any caller possessing a share link. The share lookup API endpoint fails to enforce access controls, returning sensitive account credentials and proprietary business intelligence data - event names, filters, and breakdown dimensions - without validating the caller's identity or authorization. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vulnerability is trivially exploitable by anyone who obtains a share link.
OpenPanel's server-side mutation resolvers fail to enforce project access levels, allowing read-only project members to execute 26 of 29 write operations that should be restricted to higher-privileged roles. Affected actions include deleting reports and dashboards, scheduling entire projects for deletion, publishing private analytics to public share links, and modifying alerting rules - all achievable by any user with the lowest valid project membership tier. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; organizations should consult GitHub Security Advisory GHSA-f9rx-pxgw-c6rg for patch details.
Cross-tenant SQL injection in OpenPanel's analytics filter builder allows authenticated attackers with project-scoped read credentials to exfiltrate other organizations' analytics data and profile PII. Unvalidated `profile.*` filter column identifiers are interpolated directly into ClickHouse WHERE clauses, enabling blind boolean oracle attacks that bypass project isolation boundaries. No public exploit code has been identified at time of analysis, but the low authentication bar and confirmed cross-tenant scope change make this a genuine priority for any multi-tenant OpenPanel deployment.
Server-side request forgery in OpenPanel before 2.3.0 lets unauthenticated remote attackers coerce the panel server into issuing arbitrary outbound requests via the GET /tools/site-checker endpoint, which accepts a fully client-controlled URL with no private-IP filtering or DNS-rebinding defenses. Attackers can reach localhost, internal-only services, and cloud metadata endpoints, harvesting HTTP response titles, headers, status codes, and SSL certificate details. Reported by VulnCheck with a fix in 2.3.0; no public exploit identified at time of analysis, though the endpoint is trivially reachable.
Unauthenticated XSS in OpenPanel before 2.3.0 allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a malicious SVG URL to the unprotected favicon proxy endpoint GET /misc/favicon. Because the SVG is served from the OpenPanel API origin, embedded scripts inherit same-origin context, enabling the attacker's code to issue credentialed requests against authenticated admin API endpoints on the victim's behalf. No public exploit code has been identified at time of analysis, but the attack requires only standard web delivery and a logged-in admin victim.
Unauthenticated SSRF in OpenPanel before 2.3.0 exposes two utility endpoints - /misc/favicon and /misc/og - that blindly fetch attacker-supplied URLs without adequate validation. Any remote, unauthenticated attacker can direct the OpenPanel server to query internal network hosts or cloud metadata services (such as AWS IMDSv1 at 169.254.169.254), with response bodies returned verbatim to the attacker, enabling direct theft of cloud IAM credentials and systematic enumeration of internal services. The vendor has released a fix in version 2.3.0 per the GitHub Security Advisory GHSA-2hff-m67f-2w2w; no public exploit code or CISA KEV listing is identified at time of analysis.
Authenticated remote code execution in OpenPanel before 2.3.0 allows any project member with read access to escape the mathjs formula sandbox by traversing matrix object prototypes to recover the native JavaScript Function constructor. Once recovered, the constructor enables loading Node.js core modules such as child_process, granting full OS command execution with the privileges of the API process. The vulnerability crosses organization authorization boundaries, meaning a low-privileged member of one project can pivot to affect all organizations co-hosted on the same OpenPanel instance. No public exploit has been identified at time of analysis.
Unauthenticated access to the Bull Board queue dashboard in OpenPanel self-hosted deployments before 3.0.0 exposes queue administration on the worker HTTP port: anyone who can reach that port can load the dashboard, list every BullMQ queue (with readOnlyMode:false and allowRetries:true), read queue data, Prometheus metrics and Redis/PostgreSQL/ClickHouse health, and call mutating Bull Board endpoints such as add, retry and clean. Exposure is deployment-dependent - the default docker-compose.template.yml does not publish the worker port, but the shipped Coolify template assigns SERVICE_FQDN_OPBULLBOARD to the worker and thereby publishes the UI on a public hostname, and the reporter's test instance bound the port on all interfaces. The vendor advisory includes PoC requests demonstrating HTTP 200 on GET / and GET /api/queues with no 401, but a crafted privileged job add was not demonstrated; EPSS is 0.27% (19th percentile) and there is no CISA KEV entry, and the vendor fixed the issue in 3.0.0.
Improper escaping in OpenPanel's sankey.service.ts lets any authenticated member of a project - read access alone is sufficient - supply an events[].name value containing a backslash to the chart.sankey procedure and break out of the ClickHouse string literal, producing a parse error that takes the project's Sankey chart endpoint offline. The flaw affects OpenPanel releases before 3.0.0 and is a self-contained availability issue: only the one chart feature the attacker can already read is disrupted, with no confidentiality or integrity impact and no cross-tenant reach. The reporter could break the literal but not convert it into a working injection, so the practical effect is denial of a single feature; EPSS is only 0.23% (14th percentile), the issue is not in CISA KEV, and no confirmed exploitation has been reported. Authentication requirements are confirmed as low-privileged (PR:L in the CVSS vector). Vendor-released patch: 3.0.0.
Unauthenticated cross-tenant disclosure in OpenPanel before 3.0.0 allows any remote attacker to read other tenants' project annotations - release notes, deploy markers and internal event notes - by calling the public reference.getChartReferences tRPC procedure with a guessed slug-based projectId. The handler never reads the session and performs no project-access or share-token check, so it returns title, description and date rows for any project whose ID the attacker can guess; impact is confidentiality-only (CVSS 6.9, assessed as CVSS:3.1 C:L with no integrity or availability effect). EPSS is 0.25% (16th percentile) and there is no CISA KEV listing, but the vendor advisory documents a public proof-of-concept request and the issue is fixed in 3.0.0.
Unauthenticated bot-event disclosure in OpenPanel (all versions before 3.0.0) lets anyone POST to the event.bots tRPC procedure with only a projectId and receive bot-event rows - name, type, path and created_at - from projects whose overview share is private or password-protected. The procedure's anonymous branch only checks that a shareOverview row exists and never reads the share's public flag or password, so a share that was created and later toggled off (the share router has no delete path, so the row persists) still leaks, and the exposed path field can reveal internal routes. Impact is confidentiality-only against projects that have such a share row; EPSS is low at 0.21% (11th percentile), SSVC records exploitation as none, a public PoC request is documented in the advisory but is not verified as working exploit code, and the vendor has released a fix in 3.0.0.
Missing authorization in OpenPanel's onboarding.project tRPC mutation lets any authenticated organization member - including a read-only one - create unlimited projects and mint plaintext write-type ingestion credentials inside that organization, bypassing the admin-only policy that the sibling procedures project.create and client.create enforce. All releases before 3.0.0 are affected (2.3.0 confirmed vulnerable), and the minted write-type secret cannot read existing data or manage resources, so impact is bounded to injecting fake analytics events, poisoning business metrics and consuming the organization's usage budget. EPSS is low (0.24%, 15th percentile), there is no CISA KEV entry, and the upstream GHSA advisory publishes a working PoC request (a single tRPC call over the dashboard httpLink with a non-admin member session cookie).
Read-level project members in OpenPanel before 3.0.0 can retrieve the argon2id hashes of every ingestion credential in a project by calling the client.list tRPC query, which returns full Prisma Client rows because the findMany call carries neither a select nor an omit clause. The vendor advisory includes a PoC reference request showing the expected response shape; it is not verified as working exploit code, there is no CISA KEV entry, and EPSS is 0.22% (12th percentile). Realistic risk is limited: the underlying secrets are roughly 80-bit random values and the stored hashes use argon2id (m=19456, t=2, p=1), so the leak chiefly enables offline confirmation of secrets obtained elsewhere without using the credential against the live API and without leaving an audit trail.
Authentication bypass in the OpenPanel tracking API allows unauthenticated remote attackers to inject forged revenue metrics and evade bot-detection filters by supplying arbitrary dummy secrets-only a public client ID, intentionally exposed in the client-side tracking snippet, is required. Affected versions extend through commit bad75bddc74d12d36cfb843f4531d3b830a8d994; the flaw is a moderate-severity integrity issue (CVSS 3.1 I:L) with no public exploit identified at time of analysis.
Authenticated SQL injection in OpenPanel's ClickHouse-backed metrics and filter functionality lets a user with access to at least one project inject boolean SQL terms through crafted property/filter keys, bypassing project isolation to read analytics metrics belonging to other projects. All deployments of OpenPanel up through commit bad75bdd that expose the ClickHouse metrics/filter feature are affected; the CVSS 4.0 base score is 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L), reflecting a bounded, read-only, cross-tenant confidentiality impact rather than code execution or data tampering. At the time of analysis there is no indication of confirmed active exploitation (CISA KEV) and no public exploit code identified; the primary risk drivers are the authentication requirement (PR:L) and the fact that only metrics data can be read, not modified.
Credential exposure in OpenPanel's Model Context Protocol (MCP) integration causes MCP authentication tokens supplied as URL query parameters to be written verbatim into plaintext application logs, letting anyone who can read application stdout, container/pod logs, or a centralized logging/SIEM store harvest base64-encoded credentials and replay MCP requests for read access to project analytics. The issue is gated by prior read access to the log data (CVSS 4.0 vector AV:L/PR:L; the independent assessment scores it low at CVSS 3.1 with only low confidentiality impact and no integrity or availability effect), so it is a real but low-priority defect rather than a remote unauthenticated path. No public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) status is indicated in the provided data.
Server-side request forgery in OpenPanel's data importer allows authenticated organization members to probe internal network hosts, services, and cloud metadata endpoints. The flaw exists because `parseRemoteFile` in `packages/importer/src/providers/umami.ts` calls plain `fetch()` on a caller-supplied `config.fileUrl` validated only by Zod's `z.string().url()` format check, entirely bypassing the project's own SSRF guard at `apps/api/src/utils/safe-fetch.ts`; the shared `createFileImportConfig` factory exposes the same unguarded field. An additional access-control bug means even a default 'member' with no project_access rows can exploit this path, because `getProjectAccess` returns boolean `true` instead of a level object, causing the intended access-level check to be skipped. No patched release was available at time of publication, and no public exploit has been identified at time of analysis.
Cross-tenant insecure direct object reference in Openpanel before 2.3.0 allows authenticated users to read or reset other tenants' dashboard layouts by supplying arbitrary dashboardId values in tRPC API calls. The report.getLayouts and report.resetLayout tRPC procedures accept a caller-supplied dashboardId without verifying it belongs to the authenticated user's own projectId, enabling horizontal privilege escalation across tenant boundaries. No public exploit code has been identified, and no active exploitation is confirmed, but the flaw is trivially exploitable by any authenticated user on a shared Openpanel instance.
Cross-tenant broken object level authorization (BOLA) in OpenPanel before 2.3.0 exposes confidential report definitions and enables permanent destruction of dashboard layouts across tenant boundaries. The `report.getLayouts` and `report.resetLayout` tRPC procedures accept caller-supplied `projectId` values without verifying tenant ownership, allowing any authenticated user to target a victim organization's dashboards by supplying guessable `dashboardId` values. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated full-read SSRF in Openpanel before 2.3.0 enables remote attackers to issue arbitrary server-side HTTP requests through the /tools/site-checker endpoint, with no authentication, IP allowlisting, or SSRF mitigation in place. The endpoint's url query parameter is passed directly to fetchWithRedirects() in apps/api/src/controllers/tools.controller.ts, allowing attackers to reach cloud instance metadata services (e.g., AWS IMDS at 169.254.169.254), enumerate internal ports, and retrieve response content including status codes, page sizes, and parsed HTML metadata. A secondary leakage path via getIPInfo() exfiltrates internal IP addresses to a third-party service, exposing network topology data beyond the attacker's direct channel. No public exploit code has been identified at time of analysis.
Cross Site Request Forgery vulnerability in Open Panel OpenAdmin v.0.3.4 allows a remote attacker to escalate privileges via the Change Root Password function. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
OpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue found in the Copy and View functions in the File Manager component of OpenPanel v0.3.4 allows attackers to execute a directory traversal via a crafted HTTP request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in OpenPanel v0.3.4 to v0.2.1 allows attackers to execute a directory traversal in File Actions of File Manager. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.