Is CVE-2026-116813 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116813 being exploited in the wild.

How severe is CVE-2026-116813?

Medium severity, with a CVSS score of 6.5, published 27 October 2026.

Which products and versions are affected?

Openpanel-dev OpenPanel before 3.0.0.

How is CVE-2026-116813 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-116813?

Check whether you run Openpanel-dev OpenPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116813: OpenPanel SQL injection in ConversionService.getConversion

CVE-2026-116813 · Severity: medium · CVSS 6.5 · Published 2026-10-27

OpenPanel is an open-source analytics platform that tracks user events and conversions. A SQL injection vulnerability in the conversion query builder allows authenticated users (project readers and share-link holders) to escape tenant scope and read analytics data from other organizations. An attacker can inject SQL through event names or date parameters to bypass access controls and access unauthorized analytics.

Technologies: Openpanel-dev OpenPanel. Vendors: Openpanel-dev.

Quick answers

Is CVE-2026-116813 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116813 being exploited in the wild.
How severe is CVE-2026-116813?: Medium severity, with a CVSS score of 6.5, published 27 October 2026.
Which products and versions are affected?: Openpanel-dev OpenPanel before 3.0.0.
Is there a fix for CVE-2026-116813?: No fixed version is recorded yet. Restrict project-read member access and share-link holder permissions until upgrade. Apply sqlstring.escape() to all interpolated event names and date values in conversion.service.ts, mirroring the existing fix pattern in funnel.service.ts.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-116813 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-116813?: Check whether you run Openpanel-dev OpenPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict project-read member access and share-link holder permissions until upgrade. Apply sqlstring.escape() to all interpolated event names and date values in conversion.service.ts, mirroring the existing fix pattern in funnel.service.ts.</anigation> </invoke>

Technical details

ConversionService.getConversion in conversion.service.ts constructs ClickHouse SQL by interpolating event names and date values directly into string literals without escaping, adjacent to project_id scope checks that are themselves properly escaped. An authenticated project-read member can inject SQL through the series[].name parameter, or a share-link holder through startDate/endDate, using OR 1=1 to neutralize tenant scope validation and execute UNION/subquery attacks to read other organizations' data.

Affected products

Openpanel-dev OpenPanel before 3.0.0

Timeline

2026-10-11: disclosed
2026-10-27: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.