Is CVE-2026-116818 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116818?

CVE-2026-116818 has a CVSS v3 severity of HIGH (8.2).

Back

CVE-2026-116818

Description

OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count oracles to read other tenants' events and profiles, and project members can similarly inject via the cohort.preview timeframe values.