CVE-2026-116817EUVD-2026-110524
OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.0.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
OpenPanel, a self-hosted analytics and control platform, is affected through its worker service's web dashboard, which can be reached without logging in. An unauthenticated attacker could view background job queue data and system health details, and could add, retry, or delete queued jobs.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data, metrics, and datastore health.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Openpanel-dev openpanel
fixed in 3.0.0