Is CVE-2026-116805 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116805?

CVE-2026-116805 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-116805

Description

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the client.list tRPC query. Attackers can request client.list with a project ID and receive full Client rows including the secret column, enabling offline verification of leaked secrets without audit trails.