Vulnerability · Published Sep 19, 2026 · Assigned by VulnCheck
CVE-2026-93983OpenPanel through 2.3.0 SQL Injection via ClickHouse Property Key Filter
Medium 5.0
In plain English
A medium-severity SQL injection in openpanel from Openpanel-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.3%top 73.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Openpanel-dev | openpanel | 0 – through 2.3.0 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
References
- GitHub Security Advisory (GHSA-cc5p-97vc-8fwv) vendor-advisory
- VulnCheck Advisory: OpenPanel SQL Injection via ClickHouse Property Key Filter third-party-advisory