CVE-2026-85610: OpenPanel RCE Vulnerability

CVE-2026-85610 Overview

CVE-2026-85610 is a remote code execution vulnerability in OpenPanel versions prior to 2.3.0. The flaw resides in the chart formula evaluation logic, which fails to validate mathjs expressions submitted by authenticated project members. Attackers with read access can recover the native JavaScript Function constructor through mathjs matrix objects, load Node.js built-in modules, and execute operating system commands with the privileges of the API process. Exploitation bypasses organization authorization boundaries, exposing tenants beyond the attacker's assigned project. The issue is tracked under CWE-94: Improper Control of Generation of Code.

Critical Impact
Authenticated low-privilege project members can achieve arbitrary code execution on the OpenPanel API host and cross tenant boundaries.

Affected Products

OpenPanel versions prior to 2.3.0
OpenPanel deployments exposing chart formula editing to project members
Multi-tenant OpenPanel installations relying on organization-level authorization

Discovery Timeline

2026-09-04 - CVE-2026-85610 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-85610

Vulnerability Analysis

OpenPanel allows project members to define chart formulas that are evaluated server-side by the mathjs expression engine. The evaluator does not restrict access to reflective JavaScript primitives reachable through mathjs matrix objects. An authenticated user submits a crafted formula that walks the prototype chain of a matrix instance and retrieves the native Function constructor. Once obtained, the constructor is invoked to compile arbitrary JavaScript that calls require('child_process').exec or equivalent Node.js APIs.

Because the formula is evaluated inside the API worker process, executed commands inherit its permissions and file system access. Attackers can read configuration secrets, pivot to backend databases, and touch data belonging to other organizations. The vulnerability collapses OpenPanel's tenancy model because the authorization checks apply at the HTTP layer, not at the code execution boundary.

Root Cause

The root cause is an unsafe expression sandbox. mathjs supports functionality that exposes host language objects when custom sanitization is not applied. OpenPanel invoked the evaluator without disabling import, createUnit, and matrix constructor access, and without filtering prototype lookups. This permits recovery of the Function constructor and constitutes a code injection defect classified as [CWE-94].

Attack Vector

Exploitation requires an authenticated account with read access to a project and network reachability to the OpenPanel API. The attacker submits a chart definition containing the malicious formula through the standard chart creation or editing endpoint. When the server evaluates the expression to render the chart, the payload executes. No user interaction from an administrator is required, and the attack is repeatable.

The vulnerability is described in the OpenPanel GitHub Security Advisory GHSA-7476-c5cc-8999 and the VulnCheck Advisory on RCE via chart formulas.

Detection Methods for CVE-2026-85610

Indicators of Compromise

Chart definitions containing strings such as constructor, Function, require, child_process, or process.mainModule inside formula fields.
OpenPanel API process spawning shell interpreters (/bin/sh, bash, cmd.exe) or network utilities (curl, wget, nc).
Outbound connections from the OpenPanel API host to attacker-controlled infrastructure shortly after chart rendering activity.
Unexpected file writes under application temp directories or the OpenPanel installation path following chart save events.

Detection Strategies

Inspect application logs for chart creation and update events that reference mathjs matrix syntax or the constructor property.
Deploy endpoint identification rules on the OpenPanel host that alert on Node.js parent processes spawning child processes atypical for the API workload.
Enable web application firewall rules that flag POST bodies to chart endpoints containing prototype traversal patterns.

Monitoring Recommendations

Forward OpenPanel API access logs and process telemetry into a centralized data lake for correlation across tenants.
Baseline the normal process tree of the OpenPanel API service and alert on deviations, particularly shell or scripting engine children.
Track authentication events for project members who repeatedly edit or preview chart formulas outside typical business hours.

How to Mitigate CVE-2026-85610

Immediate Actions Required

Upgrade OpenPanel to version 2.3.0 or later, which restricts chart formula evaluation to a safe expression subset.
Audit existing chart definitions for suspicious formula content and remove any that reference constructor, Function, or Node.js built-ins.
Rotate API tokens, database credentials, and secrets accessible to the OpenPanel API process if compromise is suspected.
Review project membership and revoke access for accounts that no longer require it.

Patch Information

OpenPanel 2.3.0 addresses the vulnerability by validating chart formula expressions and blocking reflective access to native JavaScript constructors. Refer to the OpenPanel GitHub Security Advisory GHSA-7476-c5cc-8999 for release details and fix commits.

Workarounds

Restrict chart formula editing to trusted administrators until the patch is applied.
Place the OpenPanel API behind a reverse proxy that inspects and blocks formula payloads containing prototype traversal patterns.
Run the OpenPanel API process as an unprivileged user inside a hardened container with no-new-privileges, read-only root filesystem, and outbound network egress restrictions.

bash

# Configuration example: containment for the OpenPanel API service
docker run \
  --user 10001:10001 \
  --read-only \
  --tmpfs /tmp \
  --security-opt no-new-privileges \
  --cap-drop ALL \
  --network openpanel-internal \
  openpanel/openpanel:2.3.0