CVE-2026-116817

EUVD-2026-110524
OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data, metrics, and datastore health.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 19.01%
Common Weakness Enumeration
References
https://github.com/Openpanel-dev/openpanel/commit/193e1e3ae01aa5208b3bee754ddee2c7ce33b38d
https://github.com/Openpanel-dev/openpanel/commit/fb0b56977c82aa1ade61449df86726b0c1490f54
https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-r627-6vrh-65p9
https://www.vulncheck.com/advisories/openpanel-before-3.0.0-missing-authentication-on-worker-bull-board