# CVE-2026-116808: OpenPanel SQL injection in profile.values

Source: https://junglewise.ai/threats/cve-2026-116808-openpanel-before-3-0-0-contains-an-sql-injection-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116808 · Severity: high · CVSS 7.2 · Published 2026-10-27

OpenPanel is an analytics platform that collects and stores customer data across multiple projects in a shared database. An authenticated attacker with access to any project can inject SQL commands to read sensitive data—including emails, events, sessions, and IP addresses—from any other project or tenant, causing a serious data breach.

Technologies: [Openpanel-dev OpenPanel](https://junglewise.ai/threats/technologies/openpanel-dev-openpanel). Vendors: [Openpanel-dev](https://junglewise.ai/threats/vendors/openpanel-dev).

## Quick answers

**Is CVE-2026-116808 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116808 being exploited in the wild.

**How severe is CVE-2026-116808?** High severity, with a CVSS score of 7.2, published 27 October 2026.

**Which products and versions are affected?** Openpanel-dev OpenPanel before 3.0.0.

**Is there a fix for CVE-2026-116808?** Yes: fixed in 3.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116808 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-116808?** Check whether you run Openpanel-dev OpenPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.0.0

## Technical details

The profile.values endpoint interpolates an attacker-controlled property parameter directly into a ClickHouse SELECT expression without validation or escaping, allowing SQL injection. An authenticated user can craft a SELECT statement with custom FROM/WHERE clauses and SQL comments to bypass the project_id scope filter and extract arbitrary data from other projects. The fix implements an allowlist of permitted column names (PROFILE_TABLE_COLUMNS) to restrict what can be queried.

## Affected products

- Openpanel-dev OpenPanel before 3.0.0

## Timeline

- 2026-10-27: advisory: CVE-2026-116808 published
- 2026-09-22: patched

## References

- [https://github.com/Openpanel-dev/openpanel/commit/a2aa053cb23e92967e812d3be5fb0f1d606d9fdc](https://github.com/Openpanel-dev/openpanel/commit/a2aa053cb23e92967e812d3be5fb0f1d606d9fdc)
- [https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-4j6c-j6vc-xq96](https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-4j6c-j6vc-xq96)

## Related threats

- [OpenPanel SQL injection in ConversionService.getConversion](https://junglewise.ai/threats/cve-2026-116813-openpanel-before-3-0-0-contains-an-sql-injection-vulnerability)
- [OpenPanel missing authorization in reference.getChartReferences](https://junglewise.ai/threats/cve-2026-116810-openpanel-before-3-0-0-contains-a-missing-authorization)
- [OpenPanel tracking API authentication bypass in client secret verification](https://junglewise.ai/threats/cve-2026-93984-openpanel-tracking-api-through-commit)