CVE-2026-116805

EUVD-2026-110513
OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the client.list tRPC query. Attackers can request client.list with a project ID and receive full Client rows including the secret column, enabling offline verification of leaked secrets without audit trails.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 12.41%
Common Weakness Enumeration
References
https://github.com/Openpanel-dev/openpanel/commit/e37d15cc2a2c908667593ff7a2ee40750f74ab5b
https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-78w9-wwff-vxqc
https://www.vulncheck.com/advisories/openpanel-before-3.0.0-information-disclosure-of-ingestion-secret-hashes-via-client-list