Medium severity5.0NVD Advisory· Published Sep 19, 2026· Updated Oct 2, 2026

CVE-2026-93983

Description

OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Openpanel Dev/Openpanelllm-fuzzy
Range: <=2.3.0

Patches

Vulnerability mechanics

References

github.com/Openpanel-dev/openpanel/security/advisories/GHSA-cc5p-97vc-8fwvnvd
www.vulncheck.com/advisories/openpanel-sql-injection-via-clickhouse-property-key-filternvd

News mentions

No linked articles in our index yet.

cvss	0.325
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000