CVE-2026-93982

Received Received - Intake

OpenPanel MCP Token Exposure in Logs

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: VulnCheck

Description

OpenPanel through commit bad75bdd writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and access project analytics.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-93982

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

OpenPanel logs Model Context Protocol authentication tokens from URL query parameters in plaintext without redaction. Attackers with access to logs can capture these base64-encoded credentials to replay MCP requests and access project analytics.

Detection Guidance

Check application logs for base64-encoded strings in URL query parameters. Search for patterns like 'token=' or 'mcp_token=' in stdout or log files. Use commands like 'grep -r "token=" /var/log/' or 'journalctl -u openpanel --no-pager | grep -i token' to inspect logs.

Impact Analysis

If you use OpenPanel, attackers with log access could steal credentials and gain unauthorized access to your project analytics. This could lead to data breaches or misuse of sensitive information.

Compliance Impact

This vulnerability could violate GDPR or HIPAA by exposing sensitive authentication tokens in logs, potentially leading to unauthorized data access. Compliance may be impacted due to insufficient protection of credentials.

Mitigation Strategies

Disable logging of URL query parameters in the application configuration. Update OpenPanel to a version that redacts sensitive tokens from logs. Rotate any exposed MCP authentication tokens immediately.

Hi! I’m here to help you understand CVE-2026-93982. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70