CVE-2026-116810 in OpenPanel
Summary
by MITRE • 10/27/2026
OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers can send requests with guessable slug-based project IDs to dump cross-tenant annotation titles, descriptions, and dates such as release notes and deploy markers.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in OpenPanel versions prior to 3.0.0 represents a critical failure in access control mechanisms, specifically categorized under CWE-287: Improper Authentication or CWE-862: Missing Authorization. This flaw resides within the application's tRPC implementation, where the procedure reference.getChartReferences is exposed as a public endpoint without requiring any form of user authentication or session validation. In modern web architectures that utilize remote procedure calls over HTTP, such endpoints must strictly enforce identity verification before processing requests to ensure that users can only access data associated with their authorized tenants or projects. The absence of these checks allows unauthenticated actors to interact directly with the backend logic as if they were legitimate, logged-in administrators or developers.
The technical exploitation vector relies on the predictability and sequential nature of project identifiers used within the OpenPanel ecosystem. By leveraging guessable slug-based project IDs, an attacker can systematically iterate through potential identifier values to enumerate resources across multiple tenants. This capability transforms a simple authorization bypass into a broader data exfiltration risk, as it enables cross-tenant access where one organization's sensitive information is exposed to another or to the public internet. The specific procedure targeted returns chart references which inherently contain metadata about project annotations, including titles, descriptions, and timestamps associated with significant events such as release notes and deployment markers.
The operational impact of this vulnerability extends beyond simple data leakage into potential strategic intelligence gathering for attackers. Release notes often detail new features, bug fixes, or architectural changes that may reveal underlying technologies in use, while deploy markers indicate the timing and frequency of updates. This information can be instrumental for threat actors conducting reconnaissance to identify windows of opportunity during deployments when systems might be more vulnerable due to ongoing configuration changes or restarts. Furthermore, the exposure of annotation descriptions could disclose internal workflows, security policies, or known issues that have not yet been publicly documented, thereby reducing the attacker's effort in crafting subsequent targeted attacks against specific components of the infrastructure.
Mitigation strategies must prioritize immediate remediation through software updates and temporary architectural adjustments. The primary solution is to upgrade OpenPanel to version 3.0.0 or later, where this authorization gap has presumably been addressed by implementing proper middleware that validates user sessions before executing tRPC procedures. For environments unable to patch immediately due to operational constraints, network-level controls such as Web Application Firewalls can be configured to block requests to the reference.getChartReferences endpoint from unauthenticated sources. Additionally, reviewing and randomizing project slug generation processes can reduce the efficacy of enumeration attacks by making identifier prediction significantly more difficult, although this is a compensating control rather than a fix for the underlying authorization flaw. Continuous monitoring of access logs for unusual patterns of sequential ID requests should also be implemented to detect potential exploitation attempts in real-time.