Is CVE-2026-116806 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116806 being exploited in the wild.

How severe is CVE-2026-116806?

Medium severity, with a CVSS score of 5.4, published 27 October 2026.

How is CVE-2026-116806 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-116806?

Check whether you run OpenPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116806: OpenPanel missing authorization in onboarding.project

CVE-2026-116806 · Severity: medium · CVSS 5.4 · Published 2026-10-27

OpenPanel is an analytics platform that allows organizations to track user behavior and events. A missing authorization check in its project setup feature allows non-admin organization members to create projects and generate write credentials that are supposed to be admin-only, letting them inject fake analytics data, poison business metrics, and consume the organization's event budget.

Technologies: OpenPanel. Vendors: OpenPanel.

Quick answers

Is CVE-2026-116806 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116806 being exploited in the wild.
How severe is CVE-2026-116806?: Medium severity, with a CVSS score of 5.4, published 27 October 2026.
Which products and versions are affected?: OpenPanel before 3.0.0.
Is there a fix for CVE-2026-116806?: Yes: fixed in 3.0.0. Until then: Restrict onboarding.project mutation access to users with zero existing organization memberships (true first-login scenario), or stop returning minted secrets from the endpoint and route users through the existing credential management interface instead. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116806 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-116806?: Check whether you run OpenPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.0.0

Restrict onboarding.project mutation access to users with zero existing organization memberships (true first-login scenario), or stop returning minted secrets from the endpoint and route users through the existing credential management interface instead.

Technical details

The onboarding.project tRPC mutation performs credential minting (project and write-type client creation) but only validates organization membership, not admin role, unlike the sibling project.create and client.create procedures which enforce requireOrganizationAdmin. An authenticated member can repeatedly call the endpoint with an organizationId they belong to, obtaining plaintext write credentials and injecting arbitrary events. The vulnerability is a logic flaw in authorization middleware that bypasses the documented admin-tier policy; no authentication bypass is required.

Affected products

Openpanel OpenPanel before 3.0.0

Timeline

2026-10-11: disclosed: GitHub security advisory GHSA-5f38-q67m-mcmp published
2026-10-27: advisory: CVE-2026-116806 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.