CVE-2026-116815
OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can submit crafted events[].name values to the chart.sankey procedure, causing ClickHouse parse errors that disable the project's Sankey chart endpoint.
| CWE | CWE-116 |
| Vendor | openpanel-dev |
| Product | openpanel |
| Published | Oct 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for openpanel-dev openpanel
Be the first to know when new medium vulnerabilities affecting openpanel-dev openpanel are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Affected Versions
Openpanel-dev / openpanel
0 < 3.0.0
References
Credits
🔍 kta1kri