---
id: CVE-2026-116817
title: OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board
summary: >-
  OpenPanel before 3.0.0 contains a missing authentication vulnerability that
  allows unauthenticated attackers to access the Bull Board dashboard served on
  the worker HTTP port. Attackers can query /api/queues and call mutating Bull
  Board …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-306
vendor: Openpanel-dev
product: openpanel
affected:
  - openpanel < 3.0.0
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-02T18:59:15.902390Z'
exploitAvailable: true
published: '2026-10-26'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T18:59:38.557Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116817'
references:
  - url: >-
      https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-r627-6vrh-65p9
    label: GitHub Security Advisory (GHSA-r627-6vrh-65p9)
  - url: >-
      https://github.com/Openpanel-dev/openpanel/commit/fb0b56977c82aa1ade61449df86726b0c1490f54
  - url: >-
      https://github.com/Openpanel-dev/openpanel/commit/193e1e3ae01aa5208b3bee754ddee2c7ce33b38d
  - url: >-
      https://www.vulncheck.com/advisories/openpanel-before-3.0.0-missing-authentication-on-worker-bull-board
    label: >-
      VulnCheck Advisory: OpenPanel before 3.0.0 Missing Authentication on
      Worker Bull Board
tags:
  - cve.org
  - exploit-available
epss: 0.00565
epssPercentile: 0.47071
exploits:
  nuclei:
    - CVE-2026-116817
  checkedAt: '2026-11-05T19:31:18.370Z'
ingestedAt: '2026-10-27T16:11:59.146Z'
---

## Overview

OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data, metrics, and datastore health.

## Affected

- `openpanel < 3.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.