Vulnerability · Published Sep 19, 2026 · Assigned by VulnCheck
CVE-2026-93982OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext
Low 3.3
In plain English
A low-severity sensitive data in logs in openpanel from Openpanel-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 94.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and access project analytics.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Openpanel-dev | openpanel | 0 – through 2.3.0 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Security Advisory (GHSA-8wx6-g25r-2943) vendor-advisory
- VulnCheck Advisory: OpenPanel MCP Authentication Token in Query Parameter Logged Plaintext third-party-advisory