Is CVE-2026-116805 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116805 being exploited in the wild.

How severe is CVE-2026-116805?

Medium severity, with a CVSS score of 4.3, published 27 October 2026.

How is CVE-2026-116805 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-116805?

Check whether you run OpenPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116805: OpenPanel information disclosure via client.list

CVE-2026-116805 · Severity: medium · CVSS 4.3 · Published 2026-10-27

OpenPanel is an analytics platform that manages ingestion credentials for tracking user events. A flaw in the client.list API query allows any project member with read-level access to retrieve hashed passwords of ingestion credentials, enabling offline verification of leaked secrets without leaving audit trails. While the hashes themselves are difficult to crack due to strong argon2id parameters, the exposure violates the application's own security policy and undermines defense-in-depth protections.

Technologies: OpenPanel. Vendors: OpenPanel.

Quick answers

Is CVE-2026-116805 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116805 being exploited in the wild.
How severe is CVE-2026-116805?: Medium severity, with a CVSS score of 4.3, published 27 October 2026.
Which products and versions are affected?: OpenPanel before 3.0.0.
Is there a fix for CVE-2026-116805?: Yes: fixed in 3.0.0. Until then: Restrict the client.list query to only return non-secret fields (id, name, type, projectId, organizationId, createdAt, updatedAt, ignoreCorsAndSecret) by adding an explicit select or omit clause to the Prisma query, matching the redaction pattern already applied to the integration router. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116805 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-116805?: Check whether you run OpenPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.0.0

Restrict the client.list query to only return non-secret fields (id, name, type, projectId, organizationId, createdAt, updatedAt, ignoreCorsAndSecret) by adding an explicit select or omit clause to the Prisma query, matching the redaction pattern already applied to the integration router.

Technical details

The client.list tRPC query in OpenPanel fails to omit the secret column when fetching Client rows from the database, exposing argon2id password hashes to authorized-but-unnecessary recipients. The vulnerability affects read-level project members who can call the query with a project ID; the authorization check at the API layer is correct, but the Prisma query returns full rows without a select or omit clause. An attacker with read access can obtain hashes of all ingestion credentials in a project and verify offline whether a separately-leaked secret matches, without using the credential and thus without triggering audit logs.

Affected products

OpenPanel OpenPanel before 3.0.0

Timeline

2026-10-11: disclosed
2026-09-23: patched: Fix committed before public disclosure

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.