CVE-2026-116815 in OpenPanel
Summary
by MITRE • 10/27/2026
OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can submit crafted events[].name values to the chart.sankey procedure, causing ClickHouse parse errors that disable the project's Sankey chart endpoint.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in OpenPanel versions prior to 3.0.0 represents a classic injection flaw rooted in improper input validation and escaping mechanisms within the application layer. Specifically, the defect resides in the sankey.service.ts module, which handles data processing for Sankey chart visualizations. The core technical issue arises when user-supplied event names are passed directly into SQL queries targeting ClickHouse without adequate sanitization of special characters, particularly backslashes. This failure to properly escape input allows authenticated users with project-level access to manipulate the structure of database commands, leading to syntax errors that disrupt service availability for specific features rather than causing data exfiltration or remote code execution in this instance.
From a technical perspective, the vulnerability exploits how ClickHouse parses string literals within its query engine. When an attacker submits a crafted event name containing backslash characters via the events array parameter to the chart.sankey procedure, these characters interfere with the SQL parser's ability to correctly identify string boundaries. This results in malformed queries that trigger parse errors on the database server side. Because the application likely does not implement robust error handling or fallback mechanisms for such failures, the immediate operational impact is a denial of service condition localized to the Sankey chart endpoint. Users attempting to view these specific visualizations will encounter failure states, effectively disabling this analytical feature for the affected project until the underlying query logic is corrected or the malicious input is filtered out at the application level.
This flaw aligns with Common Weakness Enumeration (CWE) category CWE-78, which covers Improper Neutralization of Special Elements used in an OS Command, and more specifically CWE-94, describing Improper Control of Generation of Code (Code Injection), as it involves manipulating server-side script execution through database query manipulation. In the context of the MITRE ATT&CK framework, this vulnerability can be mapped to T1053 Scheduled Task/Job, although in a web application context, it is more accurately described under techniques related to Application Layer Attacks such as SQL Injection (T1190) or potentially Denial of Service via resource exhaustion if repeated attempts degrade performance. However, given the specific mechanism of breaking string literals to cause parse errors, it primarily reflects weaknesses in input validation and output encoding standards defined by OWASP Top 10, particularly those related to injection flaws affecting data-driven applications.
Mitigation strategies must focus on implementing strict input validation and parameterized queries within the sankey.service.ts module. Developers should ensure that all user-supplied inputs, especially those destined for database operations, are sanitized using whitelisting approaches where possible or properly escaped using library functions provided by the ClickHouse client driver. Additionally, employing prepared statements with bound parameters is critical to prevent any form of injection-based manipulation regardless of input content. For existing deployments running versions before 3.0.0, immediate patching to version 3.0.0 or later is required to resolve this issue. In environments where upgrading is not immediately feasible, implementing a Web Application Firewall (WAF) rule to detect and block requests containing suspicious backslash patterns in event name parameters can provide temporary protection against exploitation while maintaining service availability for legitimate users.