CVE-2026-116812 in OpenPanel
Summary
by MITRE • 10/27/2026
OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members to inject SQL by supplying unescaped profile filter column names. Attackers can submit a cohort.preview filter whose name contains a subquery spliced into argMax, cityHash64, or comparison clauses to read other tenants' ClickHouse data.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in OpenPanel versions prior to 3.0.0 represents a critical SQL injection flaw located within the profileColumnAccess function of the cohort.service.ts module. This security defect arises from insufficient input validation and sanitization mechanisms when processing user-supplied filter parameters, specifically those related to column names used for profiling cohorts. The core technical failure lies in the application's handling of unescaped profile filter column names, which are directly concatenated into SQL queries without adequate protection against malicious syntax injection. Because the system fails to properly escape or parameterize these inputs, an attacker can manipulate the structure of the underlying database query by injecting arbitrary SQL code through carefully crafted input strings.
The operational impact of this vulnerability is severe due to its potential for cross-tenant data exfiltration in a multi-tenanted environment. The flaw allows attackers with project-read access privileges, which are typically considered low-level and limited in scope, to escalate their capabilities significantly. By submitting a cohort.preview filter containing a maliciously crafted name that includes SQL subqueries spliced into functions such as argMax, cityHash64, or comparison clauses, an attacker can bypass intended isolation boundaries. This manipulation enables the reading of data belonging to other tenants stored within the ClickHouse database backend. The use of specific aggregation and hashing functions like argMax and cityHash64 suggests that the injected code is designed to extract sensitive information efficiently while potentially evading basic detection mechanisms based on standard SELECT statements.
From a classification perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The attack vector leverages user-controllable input within the application logic to alter database queries, which is further categorized under ATT&CK technique T1059 Command and Scripting Interpreter if interpreted broadly through automated exploitation tools, or more accurately under data exfiltration techniques such as T1005 Data from Local System. The specific context of multi-tenancy highlights the importance of strict logical access controls and input validation to prevent privilege escalation and unauthorized data access across tenant boundaries.
Mitigation strategies must prioritize immediate patching to version 3.0.0 or later, where these vulnerabilities have been addressed by developers through improved sanitization protocols. In addition to upgrading, organizations should implement parameterized queries for all database interactions involving user-supplied input to ensure that column names and other identifiers are treated strictly as data rather than executable code. Furthermore, enforcing the principle of least privilege is essential; project-read members should not be granted permissions that allow them to influence query structures in ways that could impact other tenants. Regular security audits focusing on input validation logic within cohort management services will help identify similar weaknesses before they can be exploited by malicious actors seeking to compromise data integrity and confidentiality across shared infrastructure environments.