CVE-2026-93983
Received Received - Intake

OpenPanel ClickHouse SQL Injection via Unescaped Property Keys

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: VulnCheck

Description
OpenPanel through commit bad75bdd fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-19
Last Modified
2026-09-19
Generated
2026-09-20
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-93983

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenPanel fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can craft filter names to bypass project isolation and access metrics from other projects.

Detection Guidance

This vulnerability involves SQL injection in OpenPanel's ClickHouse queries due to unescaped property keys. Detection requires checking for unusual SQL query patterns or unauthorized data access. Monitor logs for ClickHouse queries containing boolean terms like 'OR 1=1' or crafted filter names. Review OpenPanel's SQL query logs for suspicious property keys that bypass project isolation.

Impact Analysis

An attacker with authenticated access could manipulate SQL queries to access unauthorized project metrics, potentially exposing sensitive data or violating project isolation.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating confidentiality requirements in GDPR and HIPAA, potentially resulting in legal penalties or data breach notifications.

Mitigation Strategies

Update OpenPanel to the latest commit or version that includes proper escaping for property keys in ClickHouse SQL queries. Restrict authenticated user permissions to prevent SQL injection attempts. Monitor SQL query logs for unusual boolean terms or filter names.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93983. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart