EUVD-2026-110513

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the client.list tRPC query. Attackers can request client.list with a project ID and receive full Client rows including the secr...

EUVD-2026-110526

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens,...

CVE-2026-116805

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the client.list tRPC query. Attackers can request client.list with a project ID and receive full Client rows including the secr...

CVE-2026-116819

Versions of OpenPanel prior to 3.0.0 are vulnerable to an information disclosure vulnerability. The flaw exists because the notification.rules query fails to execute redactIntegration, allowing users with read-level project permissions to access plaintext integration secrets . An attacker can exp...

CVE-2026-116807

OpenPanel versions prior to 3.0.0 are vulnerable to an SQL injection vulnerability within the ClickHouse database. The flaw exists in the event.events tRPC Query , where unescaped profile filter names are injected into a JOIN subquery . Authenticated users can exploit this by supplying a crafted ...

CVE-2026-116805 OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the client.list tRPC query. Attackers can request client.list with a project ID and receive full Client rows including the secr...

CVE-2026-116805

OpenPanel versions prior to 3.0.0 are vulnerable to an information disclosure flaw via the client.list tRPC query. This vulnerability allows users with read-level project permissions to obtain argon2id hashes of ingestion credentials. By requesting client.list with a specific project ID, an attac...