CVE-2026-93983

5 MEDIUMpublic exploit available

Published 2026-09-19 · Updated 2026-09-21

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

OpenPanel through commit bad75bdd fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Weaknesses

CWE-89

Public exploit & PoC references

https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-cc5p-97vc-8fwv
https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-cc5p-97vc-8fwv

All references

https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-cc5p-97vc-8fwv
https://www.vulncheck.com/advisories/openpanel-sql-injection-via-clickhouse-property-key-filter
https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-cc5p-97vc-8fwv

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-11421
MEDIUMCVE-2026-11920
MEDIUMCVE-2026-11969
MEDIUMCVE-2026-11977
MEDIUMCVE-2026-13191
MEDIUMCVE-2026-13200
MEDIUMCVE-2026-14872
MEDIUMCVE-2026-15281

Related by shared AI tags and CWE weakness class. Browse the full archive.