# CVE-2026-116815: OpenPanel improper escaping in sankey.service.ts

Source: https://junglewise.ai/threats/cve-2026-116815-openpanel-before-3-0-0-contains-an-improper-escaping  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116815 · Severity: medium · CVSS 4.3 · Published 2026-10-27

OpenPanel is an analytics and dashboarding platform that stores event data in ClickHouse. Authenticated members can craft malicious event names containing backslashes that break the Sankey chart query parser, causing the chart endpoint to return errors and become unavailable to users of the project.

Technologies: [OpenPanel](https://junglewise.ai/threats/technologies/openpanel). Vendors: [OpenPanel](https://junglewise.ai/threats/vendors/openpanel).

## Quick answers

**Is CVE-2026-116815 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116815 being exploited in the wild.

**How severe is CVE-2026-116815?** Medium severity, with a CVSS score of 4.3, published 27 October 2026.

**Which products and versions are affected?** OpenPanel before 3.0.0.

**Is there a fix for CVE-2026-116815?** Yes: fixed in 3.0.0. Until then: Replace hand-rolled string escaping with the sqlstring.escape helper function already used elsewhere in the codebase, which properly escapes backslashes in addition to quotes for ClickHouse compatibility. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116815 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116815?** Check whether you run OpenPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.0.0

Replace hand-rolled string escaping with the sqlstring.escape helper function already used elsewhere in the codebase, which properly escapes backslashes in addition to quotes for ClickHouse compatibility.

## Technical details

The vulnerability is an improper output escaping flaw in sankey.service.ts where ClickHouse string literals are escaped by only doubling single quotes, but ClickHouse also interprets backslash escapes (e.g., \' terminates the string early). An authenticated project member with read access can submit crafted event names to the chart.sankey procedure that break the query string parsing, causing denial of service to the Sankey chart endpoint, though full SQL injection is structurally prevented by the query template.

## Affected products

- OpenPanel OpenPanel before 3.0.0

## Timeline

- 2026-10-11: disclosed
- 2026-10-27: advisory

## References

- [https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-gvr5-22f4-pj6g](https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-gvr5-22f4-pj6g)
- [https://www.vulncheck.com/advisories/openpanel-before-3.0.0-improper-clickhouse-escaping-in-sankey-service-ts](https://www.vulncheck.com/advisories/openpanel-before-3.0.0-improper-clickhouse-escaping-in-sankey-service-ts)

## Related threats

- [OpenPanel ClickHouse SQL injection](https://junglewise.ai/threats/cve-2026-116818-openpanel-before-3-0-0-contains-an-unauthenticated-clickhouse)
- [OpenPanel missing authentication in Bull Board](https://junglewise.ai/threats/cve-2026-116817-openpanel-before-3-0-0-contains-a-missing-authentication)
- [OpenPanel information exposure through logs](https://junglewise.ai/threats/cve-2026-116814-openpanel-before-3-0-0-contains-an-information-exposure)
- [OpenPanel SQL injection in cohort profile filter](https://junglewise.ai/threats/cve-2026-116812-openpanel-before-3-0-0-contains-a-sql-injection-vulnerability-in)
- [OpenPanel sandbox escape in JavaScript template validator](https://junglewise.ai/threats/cve-2026-116811-openpanel-before-3-0-0-contains-a-sandbox-escape-vulnerability)