---
id: CVE-2026-116814
title: OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs
summary: >-
  OpenPanel before 3.0.0 contains an information exposure vulnerability that
  writes database connection URLs and email template data to standard output
  logs. Users with log access can obtain database credentials from migration
  startup logs…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-532
vendor: Openpanel-dev
product: openpanel
affected:
  - openpanel < 3.0.0
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T23:05:43.404Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116814'
references:
  - url: >-
      https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-xr2x-w49w-hp2c
    label: GitHub Security Advisory (GHSA-xr2x-w49w-hp2c)
  - url: >-
      https://github.com/Openpanel-dev/openpanel/commit/337b4ff8fe268c769a075a2e53206d54045cb2d5
  - url: >-
      https://github.com/Openpanel-dev/openpanel/commit/b197f024388060e37ef3b3dad43451a3d0a5d501
  - url: >-
      https://www.vulncheck.com/advisories/openpanel-before-3.0.0-sensitive-information-exposure-via-application-logs
    label: >-
      VulnCheck Advisory: OpenPanel before 3.0.0 Sensitive Information Exposure
      via Application Logs
tags:
  - cve.org
epss: 0.00277
epssPercentile: 0.19988
ingestedAt: '2026-10-27T16:11:59.144Z'
---

## Overview

OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access can obtain database credentials from migration startup logs and password-reset tokens logged when SMTP_HOST and RESEND_API_KEY are unset.

## Affected

- `openpanel < 3.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.