CVE-2026-88890

OpenPanel, an open-source analytics platform backed by ClickHouse, contains an SQL injection (CWE-89) in its analytics filter builder: filter column identifiers of the form profile.* are not validated before being interpolated into ClickHouse WHERE clauses. An attacker who already holds valid credentials with project-scoped read or root export privileges can submit crafted profile.* filter values, injecting arbitrary ClickHouse SQL. Using blind boolean-oracle techniques, the attacker can bypass project isolation and read other organizations' analytics data as well as profile PII. All OpenPanel builds through commit cd24bb8 are affected, with the highest risk in multi-tenant deployments where one tenant's credentials can be leveraged against other tenants' data. As of this writing there is no public proof of concept, the issue is not in the CISA KEV catalog, and no in-the-wild exploitation is known; the CVE was assigned by VulnCheck.

What to do: Deploy an OpenPanel build newer than commit cd24bb8 (i.e., current latest upstream) that validates profile.* filter identifiers before interpolation into ClickHouse queries. Until patched, restrict project-scoped read and root export credentials to trusted users and review ClickHouse query logs for suspicious boolean-oracle probing. Multi-tenant operators should assume that anyone holding project-scoped read or export credentials could have read other organizations' analytics data and profile PII and plan accordingly.