CVE-2026-116817 in OpenPanel
Summary
by MITRE • 10/27/2026
OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data, metrics, and datastore health.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The identified security flaw in OpenPanel versions prior to 3.0.0 represents a critical failure in access control mechanisms, specifically categorized under CWE-287 as Improper Authentication. This vulnerability stems from the absence of mandatory authentication checks for specific endpoints within the Bull Board dashboard interface, which is exposed via the worker HTTP port. In typical web application architectures, administrative or monitoring interfaces such as job queue dashboards are designed to be accessible only by authorized personnel who possess valid credentials. However, in this instance, the server configuration fails to enforce these security boundaries, allowing any network actor with connectivity to the specified port to interact directly with the underlying API without providing proof of identity.
The technical nature of this flaw allows unauthenticated attackers to perform a wide range of operations that should be restricted. By querying the /api/queues endpoint, an attacker can enumerate active jobs, inspect their payloads, and view sensitive operational metrics. More critically, the availability of mutating Bull Board APIs enables malicious actors to alter system state without authorization. This includes the ability to add new jobs to the queue, retry failed tasks, or clean up existing job data. These actions are not merely informational; they directly manipulate the application's workflow engine, potentially leading to denial of service conditions through resource exhaustion or causing data corruption if invalid payloads are injected into processing queues.
From an operational impact perspective, this vulnerability poses a severe risk to system integrity and availability. The ability to inject jobs allows for potential remote code execution scenarios depending on how those jobs are processed by the backend workers. If the job queue processes untrusted input without adequate sanitization or validation, it could lead to arbitrary command execution on the host machine. Furthermore, the capacity to clean or retry jobs disrupts normal business logic, potentially causing data loss, duplicate processing errors, or cascading failures in dependent services that rely on accurate task completion statuses. The exposure of datastore health metrics also aids attackers in reconnaissance efforts, providing insights into system load and potential weaknesses for further exploitation attempts aligned with ATT&CK techniques such as T1078 Valid Accounts if combined with credential stuffing, though here the access is entirely unauthenticated.
Mitigation strategies must prioritize immediate remediation through software updates or configuration hardening. The primary solution is to upgrade OpenPanel to version 3.0.0 or later, where this authentication gap has been addressed by the vendor. In environments where an immediate update is not feasible, network-level controls should be implemented to restrict access to the worker HTTP port exclusively from trusted internal IP addresses using firewall rules or security groups. Additionally, implementing a reverse proxy with strict authentication requirements for all administrative interfaces can provide a temporary layer of defense. It is also advisable to audit logs for any signs of unauthorized API calls and rotate any credentials that may have been exposed during the period when this vulnerability was active in production environments.