Is CVE-2026-88890 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88890 being exploited in the wild.

How severe is CVE-2026-88890?

High severity, with a CVSS score of 8.5, published 10 September 2026.

Which products and versions are affected?

Openpanel-dev OpenPanel through commit cd24bb8.

Is there a fix for CVE-2026-88890?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-88890 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-88890?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88890: OpenPanel SQL injection in analytics filter builder

CVE-2026-88890 · Severity: high · CVSS 8.5 · Published 2026-09-10

OpenPanel is an open-source product analytics platform that stores and analyzes user event data. A SQL injection vulnerability in the analytics query filter builder allows authenticated users with project credentials to inject malicious SQL commands, bypassing the per-organization data isolation controls and reading other organizations' analytics data and customer personally identifiable information (emails, names, properties). The flaw affects the profile.* filter validation, which fails to sanitize column identifiers before inserting them into ClickHouse SQL queries.

Quick answers

Is CVE-2026-88890 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88890 being exploited in the wild.
How severe is CVE-2026-88890?: High severity, with a CVSS score of 8.5, published 10 September 2026.
Which products and versions are affected?: Openpanel-dev OpenPanel through commit cd24bb8.
Is there a fix for CVE-2026-88890?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-88890 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-88890?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a column-identifier-position SQL injection (CWE-89, CWE-943) in the filter-where.service.ts module, specifically in the profileColumnSql() function. The function fails to validate or escape profile.* filter identifiers before interpolating them directly into ClickHouse WHERE clauses; sibling validation functions (groupColumnSql, sessionColumnSql) correctly use allowlists, but profileColumnSql returns the raw unvalidated identifier. An authenticated attacker with project-scoped read or root export credentials can craft a malicious profile.* filter that escapes the application-layer project_id scoping predicate, enabling blind boolean/time-oracle SQL injection across tenant boundaries. The attack is network-accessible and requires only valid API credentials; no user interaction is needed. Patches are not yet available as of the advisory publication.

Affected products

Openpanel-dev OpenPanel through commit cd24bb8

Timeline

2026-08-26: disclosed: GitHub Security Advisory GHSA-hwf2-2v2h-7892 published
2026-09-10: advisory: NVD entry CVE-2026-88890 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.