# CVE-2026-116813: OpenPanel SQL injection in ConversionService.getConversion

Source: https://junglewise.ai/threats/cve-2026-116813-openpanel-before-3-0-0-contains-an-sql-injection-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116813 · Severity: medium · CVSS 6.5 · Published 2026-10-27

OpenPanel is an open-source analytics platform that tracks user events and conversions. A SQL injection vulnerability in the conversion query builder allows authenticated users (project readers and share-link holders) to escape tenant scope and read analytics data from other organizations. An attacker can inject SQL through event names or date parameters to bypass access controls and access unauthorized analytics.

Technologies: [Openpanel-dev OpenPanel](https://junglewise.ai/threats/technologies/openpanel-dev-openpanel). Vendors: [Openpanel-dev](https://junglewise.ai/threats/vendors/openpanel-dev).

## Quick answers

**Is CVE-2026-116813 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116813 being exploited in the wild.

**How severe is CVE-2026-116813?** Medium severity, with a CVSS score of 6.5, published 27 October 2026.

**Which products and versions are affected?** Openpanel-dev OpenPanel before 3.0.0.

**Is there a fix for CVE-2026-116813?** No fixed version is recorded yet. Restrict project-read member access and share-link holder permissions until upgrade. Apply sqlstring.escape() to all interpolated event names and date values in conversion.service.ts, mirroring the existing fix pattern in funnel.service.ts.</anigation>
</invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-116813 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-116813?** Check whether you run Openpanel-dev OpenPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Restrict project-read member access and share-link holder permissions until upgrade. Apply sqlstring.escape() to all interpolated event names and date values in conversion.service.ts, mirroring the existing fix pattern in funnel.service.ts.</anigation>
</invoke>

## Technical details

ConversionService.getConversion in conversion.service.ts constructs ClickHouse SQL by interpolating event names and date values directly into string literals without escaping, adjacent to project_id scope checks that are themselves properly escaped. An authenticated project-read member can inject SQL through the series[].name parameter, or a share-link holder through startDate/endDate, using OR 1=1 to neutralize tenant scope validation and execute UNION/subquery attacks to read other organizations' data.

## Affected products

- Openpanel-dev OpenPanel before 3.0.0

## Timeline

- 2026-10-11: disclosed
- 2026-10-27: advisory

## References

- [https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-7fm7-rprq-g8rm](https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-7fm7-rprq-g8rm)
- [https://www.vulncheck.com/advisories/openpanel-before-3.0.0-clickhouse-sql-injection-via-conversion-service-ts](https://www.vulncheck.com/advisories/openpanel-before-3.0.0-clickhouse-sql-injection-via-conversion-service-ts)

## Related threats

- [OpenPanel missing authorization in reference.getChartReferences](https://junglewise.ai/threats/cve-2026-116810-openpanel-before-3-0-0-contains-a-missing-authorization)
- [OpenPanel SQL injection in profile.values](https://junglewise.ai/threats/cve-2026-116808-openpanel-before-3-0-0-contains-an-sql-injection-vulnerability)
- [OpenPanel tracking API authentication bypass in client secret verification](https://junglewise.ai/threats/cve-2026-93984-openpanel-tracking-api-through-commit)