Vulnerability · Published Oct 26, 2026 · Assigned by VulnCheck

CVE-2026-116815OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts

Medium 4.3

In plain English

A medium-severity security flaw in openpanel from Openpanel-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 86.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can submit crafted events[].name values to the chart.sankey procedure, causing ClickHouse parse errors that disable the project's Sankey chart endpoint.

Affected products (as reported)

Vendor	Product	Versions
Openpanel-dev	openpanel	0 – before 3.0.0

Weakness: CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

GitHub Security Advisory (GHSA-gvr5-22f4-pj6g) vendor-advisory
VulnCheck Advisory: OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts third-party-advisory