Openpanel Before 3.0.0 Unauthenticated Clickhouse Sql Injection Via Live Visitors Websocket

Back www.vulncheck.com

Openpanel Before 3.0.0 Unauthenticated Clickhouse Sql Injection Via Live Visitors Websocket

www.vulncheck.com • October 27, 2026

Share: View original

OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket

openpanel >= 0, = 0, < 3.0.0

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

GitHub Security Advisory (GHSA-8wr9-x797-f238)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Found in OpenPanel Before 3.0.0 OpenPanel versions prior to 3.0.0 are affected by multiple vulnerabilities including unauthenticated SQL injection via the /live/visitors WebSocket and profile values, as well as credential disclosure through notification rules queries and remote code execution via webhook JavaScript templates. These vulnerabilities are categorized under CWE-89 for SQL injection. The specific CVEs associated with these vulnerabilities include GHSA-8wr9-x797-f238 and GHSA-4j6c-j6vc-xq96, among others. The vulnerabilities allow attackers to exploit the system without authentication, potentially leading to unauthorized access and data exposure. There is currently no information indicating in the wild, but the vulnerabilities are serious enough to warrant immediate attention from users of OpenPanel. Administrators are advised to prioritize patching to mitigate these risks. 57

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

CWE-89 - SQL Injection

Platforms (3)

ClickHouse OpenPanel WebSocket