Is CVE-2026-88892 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88892 being exploited in the wild.

How severe is CVE-2026-88892?

Medium severity, with a CVSS score of 5, published 10 September 2026.

Is there a fix for CVE-2026-88892?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-88892 attacked?

It is attacked over the network.

Am I affected by CVE-2026-88892?

Check whether you run OpenPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88892: OpenPanel SSRF in data importer via unguarded fetch

CVE-2026-88892 · Severity: medium · CVSS 5 · Published 2026-09-10

OpenPanel is an analytics platform that imports data from external sources. An authenticated organization member can trick the server into making requests to internal hosts, ports, and cloud metadata services by supplying a malicious URL to the data importer. The attacker can read HTTP status codes and response details back, effectively using the platform as a scanner for internal network infrastructure, and could potentially ingest sensitive internal data into their analytics views.

Technologies: OpenPanel. Vendors: OpenPanel.

Quick answers

Is CVE-2026-88892 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88892 being exploited in the wild.
How severe is CVE-2026-88892?: Medium severity, with a CVSS score of 5, published 10 September 2026.
Which products and versions are affected?: OpenPanel all versions.
Is there a fix for CVE-2026-88892?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-88892 attacked?: It is attacked over the network.
Am I affected by CVE-2026-88892?: Check whether you run OpenPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) in the data importer component (packages/importer/src/providers/umami.ts). The parseRemoteFile function calls fetch() directly on a user-supplied fileUrl parameter with only basic URL format validation (z.string().url()), bypassing the application's existing SSRF guard (safe-fetch.ts) that validates addresses and blocks non-publicly-routable ranges. An authenticated organization member—including default members with no explicit project access—can exploit this because getProjectAccess returns a boolean true rather than an access level object, causing the intended read-level access check to be skipped. The attacker can make the server connect to loopback addresses (127.0.0.1), private networks (10.0.0.0/8, 192.168.0.0/16), and cloud metadata endpoints (169.254.169.254). HTTP error responses are reflected in Import.errorMessage and returned to the attacker, providing a scanning oracle for internal hosts and paths; if responses parse as Umami CSV, data is ingested into the attacker's analytics views. No patched version is available at time of publication.

Affected products

OpenPanel OpenPanel all versions

Timeline

2026-09-10: disclosed
2026-08-26: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.