CVE-2026-93983 Overview
CVE-2026-93983 is a SQL injection vulnerability in OpenPanel through commit bad75bdd. The application fails to escape property keys before embedding them in ClickHouse SQL queries. Authenticated users can inject boolean SQL terms through crafted filter names. Successful exploitation bypasses project isolation and exposes metrics belonging to other projects on the same instance.
The root weakness is classified as Improper Neutralization of Special Elements used in an SQL Command [CWE-89]. Because the injection point sits behind authentication and the impact is limited to reading cross-tenant metrics data, the flaw carries a medium severity rating.
Critical Impact
Authenticated attackers can read analytics metrics from projects they do not own, breaking OpenPanel's multi-tenant isolation model.
Affected Products
- OpenPanel analytics platform through commit bad75bdd
- Deployments backed by ClickHouse for event and metrics storage
- Multi-tenant OpenPanel instances hosting more than one project
Discovery Timeline
- 2026-09-19 - CVE-2026-93983 published to the National Vulnerability Database
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-93983
Vulnerability Analysis
OpenPanel builds ClickHouse queries dynamically to filter events by property keys supplied through the API. The affected code paths concatenate the user-supplied property key directly into the query string rather than parameterizing it or applying an allowlist. Because ClickHouse identifiers are quoted with backticks, an attacker who controls the key can close the identifier and append arbitrary boolean SQL fragments.
Exploitation requires an authenticated account, but no elevated privileges. Once the attacker injects a boolean term such as OR 1=1, the WHERE clause that enforces project ownership becomes tautologically true. The query then returns rows scoped to other tenants, breaking the project isolation boundary that OpenPanel relies on for multi-tenancy.
The impact is limited to confidentiality of metrics data. There is no direct write path or code execution primitive documented in the advisory, and integrity and availability metrics in the CVSS vector are unchanged.
Root Cause
The defect is missing input neutralization on property-key filter names before those values are interpolated into ClickHouse SQL. OpenPanel treats the identifier as trusted and applies no escaping, quoting normalization, or allowlist check against known schema columns.
Attack Vector
An authenticated user submits an API request containing a filter whose property key includes SQL metacharacters. The server assembles the ClickHouse statement with the malicious identifier in place, and ClickHouse executes the injected boolean expression alongside the intended predicates. The resulting rows include events from projects the caller does not own.
No verified exploit code is publicly available. See the GitHub Security Advisory and the VulnCheck SQL Injection Advisory for the vendor's technical description.
Detection Methods for CVE-2026-93983
Indicators of Compromise
- ClickHouse query_log entries containing backtick-delimited identifiers followed by boolean operators such as OR, AND, or --.
- API request logs where the property or filter-name field contains characters outside [a-zA-Z0-9_.].
- Metrics responses that reference project_id values not associated with the authenticated caller.
Detection Strategies
- Enable ClickHouse query_log and alert on queries whose identifier positions contain SQL keywords or comment sequences.
- Compare submitted filter keys against the known event-property schema and flag unknown or malformed keys.
- Correlate authenticated session identifiers with the project_id values present in returned result sets to catch cross-tenant reads.
Monitoring Recommendations
- Track per-account query volume and result cardinality; sudden increases can indicate tautology-based data harvesting.
- Forward OpenPanel application logs and ClickHouse audit logs into a centralized analytics pipeline for retention and query.
- Alert on repeated HTTP 200 responses to filter endpoints that follow syntactically unusual property-key payloads.
How to Mitigate CVE-2026-93983
Immediate Actions Required
- Upgrade OpenPanel to a commit that post-dates bad75bdd and includes the property-key escaping fix from the vendor advisory.
- Audit ClickHouse query_log for injected identifiers dating back to the earliest possible exposure window.
- Rotate any API tokens that could have been used to enumerate cross-project metrics.
Patch Information
The fix is tracked in the GitHub Security Advisory GHSA-cc5p-97vc-8fwv. Administrators running self-hosted OpenPanel should pull the latest release from the upstream repository and redeploy. Hosted-tenant users should confirm remediation status with the OpenPanel operator.
Workarounds
- Restrict API access to the analytics filter endpoints to trusted internal networks until the patched build is deployed.
- Place a reverse proxy or web application firewall in front of OpenPanel to reject filter payloads containing backticks, semicolons, or SQL comment sequences.
- Enforce ClickHouse row-level policies keyed on project_id so that the database rejects cross-tenant reads even if the application layer is bypassed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
