Openpanel Dev
Monthly
Code execution in OpenPanel's js-runtime component lets an authenticated user who holds project write access escape the JavaScript webhook template sandbox and run arbitrary code inside the worker process. The template validator fails to block computed (bracket-notation) member access that traverses a constructor chain to the Function constructor, so merely creating or editing a webhook template is sufficient - no user interaction is required (UI:N). No public exploit code has been identified at time of analysis, and no CISA KEV or EPSS signal was supplied, but our independent assessment rates this a genuine high-priority issue, with CVSS 3.1 AV:N/PR:L/UI:N/S:C/C:H/I:H/A:H (scope change to the host system and full confidentiality, integrity and availability impact).
Unauthenticated information disclosure in OpenPanel (openpanel-dev/openpanel) exposes argon2id password hashes and full report configurations to any caller possessing a share link. The share lookup API endpoint fails to enforce access controls, returning sensitive account credentials and proprietary business intelligence data - event names, filters, and breakdown dimensions - without validating the caller's identity or authorization. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vulnerability is trivially exploitable by anyone who obtains a share link.
OpenPanel's server-side mutation resolvers fail to enforce project access levels, allowing read-only project members to execute 26 of 29 write operations that should be restricted to higher-privileged roles. Affected actions include deleting reports and dashboards, scheduling entire projects for deletion, publishing private analytics to public share links, and modifying alerting rules - all achievable by any user with the lowest valid project membership tier. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; organizations should consult GitHub Security Advisory GHSA-f9rx-pxgw-c6rg for patch details.
Cross-tenant SQL injection in OpenPanel's analytics filter builder allows authenticated attackers with project-scoped read credentials to exfiltrate other organizations' analytics data and profile PII. Unvalidated `profile.*` filter column identifiers are interpolated directly into ClickHouse WHERE clauses, enabling blind boolean oracle attacks that bypass project isolation boundaries. No public exploit code has been identified at time of analysis, but the low authentication bar and confirmed cross-tenant scope change make this a genuine priority for any multi-tenant OpenPanel deployment.
Server-side request forgery in OpenPanel before 2.3.0 lets unauthenticated remote attackers coerce the panel server into issuing arbitrary outbound requests via the GET /tools/site-checker endpoint, which accepts a fully client-controlled URL with no private-IP filtering or DNS-rebinding defenses. Attackers can reach localhost, internal-only services, and cloud metadata endpoints, harvesting HTTP response titles, headers, status codes, and SSL certificate details. Reported by VulnCheck with a fix in 2.3.0; no public exploit identified at time of analysis, though the endpoint is trivially reachable.
Unauthenticated XSS in OpenPanel before 2.3.0 allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a malicious SVG URL to the unprotected favicon proxy endpoint GET /misc/favicon. Because the SVG is served from the OpenPanel API origin, embedded scripts inherit same-origin context, enabling the attacker's code to issue credentialed requests against authenticated admin API endpoints on the victim's behalf. No public exploit code has been identified at time of analysis, but the attack requires only standard web delivery and a logged-in admin victim.
Unauthenticated SSRF in OpenPanel before 2.3.0 exposes two utility endpoints - /misc/favicon and /misc/og - that blindly fetch attacker-supplied URLs without adequate validation. Any remote, unauthenticated attacker can direct the OpenPanel server to query internal network hosts or cloud metadata services (such as AWS IMDSv1 at 169.254.169.254), with response bodies returned verbatim to the attacker, enabling direct theft of cloud IAM credentials and systematic enumeration of internal services. The vendor has released a fix in version 2.3.0 per the GitHub Security Advisory GHSA-2hff-m67f-2w2w; no public exploit code or CISA KEV listing is identified at time of analysis.
Authenticated remote code execution in OpenPanel before 2.3.0 allows any project member with read access to escape the mathjs formula sandbox by traversing matrix object prototypes to recover the native JavaScript Function constructor. Once recovered, the constructor enables loading Node.js core modules such as child_process, granting full OS command execution with the privileges of the API process. The vulnerability crosses organization authorization boundaries, meaning a low-privileged member of one project can pivot to affect all organizations co-hosted on the same OpenPanel instance. No public exploit has been identified at time of analysis.
Authentication bypass in the OpenPanel tracking API allows unauthenticated remote attackers to inject forged revenue metrics and evade bot-detection filters by supplying arbitrary dummy secrets-only a public client ID, intentionally exposed in the client-side tracking snippet, is required. Affected versions extend through commit bad75bddc74d12d36cfb843f4531d3b830a8d994; the flaw is a moderate-severity integrity issue (CVSS 3.1 I:L) with no public exploit identified at time of analysis.
Authenticated SQL injection in OpenPanel's ClickHouse-backed metrics and filter functionality lets a user with access to at least one project inject boolean SQL terms through crafted property/filter keys, bypassing project isolation to read analytics metrics belonging to other projects. All deployments of OpenPanel up through commit bad75bdd that expose the ClickHouse metrics/filter feature are affected; the CVSS 4.0 base score is 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L), reflecting a bounded, read-only, cross-tenant confidentiality impact rather than code execution or data tampering. At the time of analysis there is no indication of confirmed active exploitation (CISA KEV) and no public exploit code identified; the primary risk drivers are the authentication requirement (PR:L) and the fact that only metrics data can be read, not modified.
Credential exposure in OpenPanel's Model Context Protocol (MCP) integration causes MCP authentication tokens supplied as URL query parameters to be written verbatim into plaintext application logs, letting anyone who can read application stdout, container/pod logs, or a centralized logging/SIEM store harvest base64-encoded credentials and replay MCP requests for read access to project analytics. The issue is gated by prior read access to the log data (CVSS 4.0 vector AV:L/PR:L; the independent assessment scores it low at CVSS 3.1 with only low confidentiality impact and no integrity or availability effect), so it is a real but low-priority defect rather than a remote unauthenticated path. No public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) status is indicated in the provided data.
Server-side request forgery in OpenPanel's data importer allows authenticated organization members to probe internal network hosts, services, and cloud metadata endpoints. The flaw exists because `parseRemoteFile` in `packages/importer/src/providers/umami.ts` calls plain `fetch()` on a caller-supplied `config.fileUrl` validated only by Zod's `z.string().url()` format check, entirely bypassing the project's own SSRF guard at `apps/api/src/utils/safe-fetch.ts`; the shared `createFileImportConfig` factory exposes the same unguarded field. An additional access-control bug means even a default 'member' with no project_access rows can exploit this path, because `getProjectAccess` returns boolean `true` instead of a level object, causing the intended access-level check to be skipped. No patched release was available at time of publication, and no public exploit has been identified at time of analysis.
Cross-tenant insecure direct object reference in Openpanel before 2.3.0 allows authenticated users to read or reset other tenants' dashboard layouts by supplying arbitrary dashboardId values in tRPC API calls. The report.getLayouts and report.resetLayout tRPC procedures accept a caller-supplied dashboardId without verifying it belongs to the authenticated user's own projectId, enabling horizontal privilege escalation across tenant boundaries. No public exploit code has been identified, and no active exploitation is confirmed, but the flaw is trivially exploitable by any authenticated user on a shared Openpanel instance.
Cross-tenant broken object level authorization (BOLA) in OpenPanel before 2.3.0 exposes confidential report definitions and enables permanent destruction of dashboard layouts across tenant boundaries. The `report.getLayouts` and `report.resetLayout` tRPC procedures accept caller-supplied `projectId` values without verifying tenant ownership, allowing any authenticated user to target a victim organization's dashboards by supplying guessable `dashboardId` values. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated full-read SSRF in Openpanel before 2.3.0 enables remote attackers to issue arbitrary server-side HTTP requests through the /tools/site-checker endpoint, with no authentication, IP allowlisting, or SSRF mitigation in place. The endpoint's url query parameter is passed directly to fetchWithRedirects() in apps/api/src/controllers/tools.controller.ts, allowing attackers to reach cloud instance metadata services (e.g., AWS IMDS at 169.254.169.254), enumerate internal ports, and retrieve response content including status codes, page sizes, and parsed HTML metadata. A secondary leakage path via getIPInfo() exfiltrates internal IP addresses to a third-party service, exposing network topology data beyond the attacker's direct channel. No public exploit code has been identified at time of analysis.
Code execution in OpenPanel's js-runtime component lets an authenticated user who holds project write access escape the JavaScript webhook template sandbox and run arbitrary code inside the worker process. The template validator fails to block computed (bracket-notation) member access that traverses a constructor chain to the Function constructor, so merely creating or editing a webhook template is sufficient - no user interaction is required (UI:N). No public exploit code has been identified at time of analysis, and no CISA KEV or EPSS signal was supplied, but our independent assessment rates this a genuine high-priority issue, with CVSS 3.1 AV:N/PR:L/UI:N/S:C/C:H/I:H/A:H (scope change to the host system and full confidentiality, integrity and availability impact).
Unauthenticated information disclosure in OpenPanel (openpanel-dev/openpanel) exposes argon2id password hashes and full report configurations to any caller possessing a share link. The share lookup API endpoint fails to enforce access controls, returning sensitive account credentials and proprietary business intelligence data - event names, filters, and breakdown dimensions - without validating the caller's identity or authorization. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vulnerability is trivially exploitable by anyone who obtains a share link.
OpenPanel's server-side mutation resolvers fail to enforce project access levels, allowing read-only project members to execute 26 of 29 write operations that should be restricted to higher-privileged roles. Affected actions include deleting reports and dashboards, scheduling entire projects for deletion, publishing private analytics to public share links, and modifying alerting rules - all achievable by any user with the lowest valid project membership tier. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; organizations should consult GitHub Security Advisory GHSA-f9rx-pxgw-c6rg for patch details.
Cross-tenant SQL injection in OpenPanel's analytics filter builder allows authenticated attackers with project-scoped read credentials to exfiltrate other organizations' analytics data and profile PII. Unvalidated `profile.*` filter column identifiers are interpolated directly into ClickHouse WHERE clauses, enabling blind boolean oracle attacks that bypass project isolation boundaries. No public exploit code has been identified at time of analysis, but the low authentication bar and confirmed cross-tenant scope change make this a genuine priority for any multi-tenant OpenPanel deployment.
Server-side request forgery in OpenPanel before 2.3.0 lets unauthenticated remote attackers coerce the panel server into issuing arbitrary outbound requests via the GET /tools/site-checker endpoint, which accepts a fully client-controlled URL with no private-IP filtering or DNS-rebinding defenses. Attackers can reach localhost, internal-only services, and cloud metadata endpoints, harvesting HTTP response titles, headers, status codes, and SSL certificate details. Reported by VulnCheck with a fix in 2.3.0; no public exploit identified at time of analysis, though the endpoint is trivially reachable.
Unauthenticated XSS in OpenPanel before 2.3.0 allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a malicious SVG URL to the unprotected favicon proxy endpoint GET /misc/favicon. Because the SVG is served from the OpenPanel API origin, embedded scripts inherit same-origin context, enabling the attacker's code to issue credentialed requests against authenticated admin API endpoints on the victim's behalf. No public exploit code has been identified at time of analysis, but the attack requires only standard web delivery and a logged-in admin victim.
Unauthenticated SSRF in OpenPanel before 2.3.0 exposes two utility endpoints - /misc/favicon and /misc/og - that blindly fetch attacker-supplied URLs without adequate validation. Any remote, unauthenticated attacker can direct the OpenPanel server to query internal network hosts or cloud metadata services (such as AWS IMDSv1 at 169.254.169.254), with response bodies returned verbatim to the attacker, enabling direct theft of cloud IAM credentials and systematic enumeration of internal services. The vendor has released a fix in version 2.3.0 per the GitHub Security Advisory GHSA-2hff-m67f-2w2w; no public exploit code or CISA KEV listing is identified at time of analysis.
Authenticated remote code execution in OpenPanel before 2.3.0 allows any project member with read access to escape the mathjs formula sandbox by traversing matrix object prototypes to recover the native JavaScript Function constructor. Once recovered, the constructor enables loading Node.js core modules such as child_process, granting full OS command execution with the privileges of the API process. The vulnerability crosses organization authorization boundaries, meaning a low-privileged member of one project can pivot to affect all organizations co-hosted on the same OpenPanel instance. No public exploit has been identified at time of analysis.
Authentication bypass in the OpenPanel tracking API allows unauthenticated remote attackers to inject forged revenue metrics and evade bot-detection filters by supplying arbitrary dummy secrets-only a public client ID, intentionally exposed in the client-side tracking snippet, is required. Affected versions extend through commit bad75bddc74d12d36cfb843f4531d3b830a8d994; the flaw is a moderate-severity integrity issue (CVSS 3.1 I:L) with no public exploit identified at time of analysis.
Authenticated SQL injection in OpenPanel's ClickHouse-backed metrics and filter functionality lets a user with access to at least one project inject boolean SQL terms through crafted property/filter keys, bypassing project isolation to read analytics metrics belonging to other projects. All deployments of OpenPanel up through commit bad75bdd that expose the ClickHouse metrics/filter feature are affected; the CVSS 4.0 base score is 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L), reflecting a bounded, read-only, cross-tenant confidentiality impact rather than code execution or data tampering. At the time of analysis there is no indication of confirmed active exploitation (CISA KEV) and no public exploit code identified; the primary risk drivers are the authentication requirement (PR:L) and the fact that only metrics data can be read, not modified.
Credential exposure in OpenPanel's Model Context Protocol (MCP) integration causes MCP authentication tokens supplied as URL query parameters to be written verbatim into plaintext application logs, letting anyone who can read application stdout, container/pod logs, or a centralized logging/SIEM store harvest base64-encoded credentials and replay MCP requests for read access to project analytics. The issue is gated by prior read access to the log data (CVSS 4.0 vector AV:L/PR:L; the independent assessment scores it low at CVSS 3.1 with only low confidentiality impact and no integrity or availability effect), so it is a real but low-priority defect rather than a remote unauthenticated path. No public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) status is indicated in the provided data.
Server-side request forgery in OpenPanel's data importer allows authenticated organization members to probe internal network hosts, services, and cloud metadata endpoints. The flaw exists because `parseRemoteFile` in `packages/importer/src/providers/umami.ts` calls plain `fetch()` on a caller-supplied `config.fileUrl` validated only by Zod's `z.string().url()` format check, entirely bypassing the project's own SSRF guard at `apps/api/src/utils/safe-fetch.ts`; the shared `createFileImportConfig` factory exposes the same unguarded field. An additional access-control bug means even a default 'member' with no project_access rows can exploit this path, because `getProjectAccess` returns boolean `true` instead of a level object, causing the intended access-level check to be skipped. No patched release was available at time of publication, and no public exploit has been identified at time of analysis.
Cross-tenant insecure direct object reference in Openpanel before 2.3.0 allows authenticated users to read or reset other tenants' dashboard layouts by supplying arbitrary dashboardId values in tRPC API calls. The report.getLayouts and report.resetLayout tRPC procedures accept a caller-supplied dashboardId without verifying it belongs to the authenticated user's own projectId, enabling horizontal privilege escalation across tenant boundaries. No public exploit code has been identified, and no active exploitation is confirmed, but the flaw is trivially exploitable by any authenticated user on a shared Openpanel instance.
Cross-tenant broken object level authorization (BOLA) in OpenPanel before 2.3.0 exposes confidential report definitions and enables permanent destruction of dashboard layouts across tenant boundaries. The `report.getLayouts` and `report.resetLayout` tRPC procedures accept caller-supplied `projectId` values without verifying tenant ownership, allowing any authenticated user to target a victim organization's dashboards by supplying guessable `dashboardId` values. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated full-read SSRF in Openpanel before 2.3.0 enables remote attackers to issue arbitrary server-side HTTP requests through the /tools/site-checker endpoint, with no authentication, IP allowlisting, or SSRF mitigation in place. The endpoint's url query parameter is passed directly to fetchWithRedirects() in apps/api/src/controllers/tools.controller.ts, allowing attackers to reach cloud instance metadata services (e.g., AWS IMDS at 169.254.169.254), enumerate internal ports, and retrieve response content including status codes, page sizes, and parsed HTML metadata. A secondary leakage path via getIPInfo() exfiltrates internal IP addresses to a third-party service, exposing network topology data beyond the attacker's direct channel. No public exploit code has been identified at time of analysis.