Is CVE-2026-116808 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116808 being exploited in the wild.

How severe is CVE-2026-116808?

High severity, with a CVSS score of 7.2, published 27 October 2026.

Which products and versions are affected?

Openpanel-dev OpenPanel before 3.0.0.

Is there a fix for CVE-2026-116808?

Yes: fixed in 3.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116808 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-116808?

Check whether you run Openpanel-dev OpenPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116808: OpenPanel SQL injection in profile.values

CVE-2026-116808 · Severity: high · CVSS 7.2 · Published 2026-10-27

OpenPanel is an analytics platform that collects and stores customer data across multiple projects in a shared database. An authenticated attacker with access to any project can inject SQL commands to read sensitive data—including emails, events, sessions, and IP addresses—from any other project or tenant, causing a serious data breach.

Technologies: Openpanel-dev OpenPanel. Vendors: Openpanel-dev.

Quick answers

Is CVE-2026-116808 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116808 being exploited in the wild.
How severe is CVE-2026-116808?: High severity, with a CVSS score of 7.2, published 27 October 2026.
Which products and versions are affected?: Openpanel-dev OpenPanel before 3.0.0.
Is there a fix for CVE-2026-116808?: Yes: fixed in 3.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116808 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-116808?: Check whether you run Openpanel-dev OpenPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.0.0

Technical details

The profile.values endpoint interpolates an attacker-controlled property parameter directly into a ClickHouse SELECT expression without validation or escaping, allowing SQL injection. An authenticated user can craft a SELECT statement with custom FROM/WHERE clauses and SQL comments to bypass the project_id scope filter and extract arbitrary data from other projects. The fix implements an allowlist of permitted column names (PROFILE_TABLE_COLUMNS) to restrict what can be queried.

Affected products

Openpanel-dev OpenPanel before 3.0.0

Timeline

2026-10-27: advisory: CVE-2026-116808 published
2026-09-22: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.