CVE-2026-116814
OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs
- State
- Published
- Severity
- 7.1 High
- Published
- Oct 26, 2026
- Updated
- Oct 26, 2026
- Reserved
- Oct 26, 2026
Description
OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access can obtain database credentials from migration startup logs and password-reset tokens logged when SMTP_HOST and RESEND_API_KEY are unset.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-532 Insertion of Sensitive Information into Log File
Affected Products
| Product | Versions |
|---|---|
openpanelOpenpanel-dev |
|
References
- GitHub Security Advisory (GHSA-xr2x-w49w-hp2c)vendor-advisory
- https://github.com/Openpanel-dev/openpanel/commit/337b4ff8fe268c769a075a2e53206d54045cb2d5patch
- https://github.com/Openpanel-dev/openpanel/commit/b197f024388060e37ef3b3dad43451a3d0a5d501patch
- VulnCheck Advisory: OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.