CVE-2026-116805 Details
Description
OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the client.list tRPC query. Attackers can request client.list with a project ID and receive full Client rows including the secret column, enabling offline verification of leaked secrets without audit trails.
A vulnerability allowing information disclosure exists in OpenPanel versions prior to 3.0.0. This issue enables read-level project members to access argon2id hashes of ingestion credentials through the client.list tRPC query. The vulnerability arises because the client.list query returns full Client rows, including the secret column, which contains hashed credential information. This exposure allows for offline verification of leaked secrets without leaving an audit trail.
The vulnerability has been addressed by updating the client.list query to omit the secret column from the response. This can be done by adding a select clause that specifies only the non-sensitive fields or by using a model-level omit for all Client read operations.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Oct 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenPanel | >= 0, < 3.0.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 27, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |