# CVE-2026-88890: OpenPanel SQL injection in analytics filter builder

Source: https://junglewise.ai/threats/cve-2026-88890-openpanel-sql-injection-in-analytics-filter-builder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88890 · Severity: high · CVSS 8.5 · Published 2026-09-10

OpenPanel is an open-source product analytics platform that stores and analyzes user event data. A SQL injection vulnerability in the analytics query filter builder allows authenticated users with project credentials to inject malicious SQL commands, bypassing the per-organization data isolation controls and reading other organizations' analytics data and customer personally identifiable information (emails, names, properties). The flaw affects the profile.* filter validation, which fails to sanitize column identifiers before inserting them into ClickHouse SQL queries.

## Quick answers

**Is CVE-2026-88890 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88890 being exploited in the wild.

**How severe is CVE-2026-88890?** High severity, with a CVSS score of 8.5, published 10 September 2026.

**Which products and versions are affected?** Openpanel-dev OpenPanel through commit cd24bb8.

**Is there a fix for CVE-2026-88890?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88890 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-88890?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a column-identifier-position SQL injection (CWE-89, CWE-943) in the filter-where.service.ts module, specifically in the profileColumnSql() function. The function fails to validate or escape profile.* filter identifiers before interpolating them directly into ClickHouse WHERE clauses; sibling validation functions (groupColumnSql, sessionColumnSql) correctly use allowlists, but profileColumnSql returns the raw unvalidated identifier. An authenticated attacker with project-scoped read or root export credentials can craft a malicious profile.* filter that escapes the application-layer project_id scoping predicate, enabling blind boolean/time-oracle SQL injection across tenant boundaries. The attack is network-accessible and requires only valid API credentials; no user interaction is needed. Patches are not yet available as of the advisory publication.

## Affected products

- Openpanel-dev OpenPanel through commit cd24bb8

## Timeline

- 2026-08-26: disclosed: GitHub Security Advisory GHSA-hwf2-2v2h-7892 published
- 2026-09-10: advisory: NVD entry CVE-2026-88890 published

## References

- [https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-hwf2-2v2h-7892](https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-hwf2-2v2h-7892)
- [https://www.vulncheck.com/advisories/openpanel-sql-injection-via-unvalidated-profile-filter-column-identifier](https://www.vulncheck.com/advisories/openpanel-sql-injection-via-unvalidated-profile-filter-column-identifier)