Quick answers
- Is CVE-2026-116815 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116815 being exploited in the wild.
- How severe is CVE-2026-116815?
- Medium severity, with a CVSS score of 4.3, published 27 October 2026.
- Which products and versions are affected?
- OpenPanel before 3.0.0.
- Is there a fix for CVE-2026-116815?
- Yes: fixed in 3.0.0. Until then: Replace hand-rolled string escaping with the sqlstring.escape helper function already used elsewhere in the codebase, which properly escapes backslashes in addition to quotes for ClickHouse compatibility. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-116815 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-116815?
- Check whether you run OpenPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 3.0.0
Replace hand-rolled string escaping with the sqlstring.escape helper function already used elsewhere in the codebase, which properly escapes backslashes in addition to quotes for ClickHouse compatibility.
Technical details
The vulnerability is an improper output escaping flaw in sankey.service.ts where ClickHouse string literals are escaped by only doubling single quotes, but ClickHouse also interprets backslash escapes (e.g., \' terminates the string early). An authenticated project member with read access can submit crafted event names to the chart.sankey procedure that break the query string parsing, causing denial of service to the Sankey chart endpoint, though full SQL injection is structurally prevented by the query template.
Affected products
- OpenPanel OpenPanel before 3.0.0
Timeline
- 2026-10-11: disclosed
- 2026-10-27: advisory