Description

OpenPanel through commit bad75bdd writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and access project analytics.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-19T12:16:41.310Z",
  "pubdate": "2026-09-19T12:16:41.310Z",
  "executiveSummary": "OpenPanel, up to commit bad75bdd, suffers from a critical information disclosure vulnerability involving the improper handling of Model Context Protocol (MCP) authentication tokens.\nThe application insecurely writes authentication tokens received via URL query parameters directly into plaintext application logs without applying necessary redaction patterns.\nThis flaw allows any entity or process with read access to the application stdout stream or centralized log aggregation systems to intercept these base64-encoded credentials.\nThe primary impact is the unauthorized exposure of authentication material, which enables attackers to perform replay attacks against the MCP interface.\nBy capturing these tokens, an unauthorized party can impersonate a legitimate user, gain unauthorized access to internal project analytics, and potentially interact with the MCP-enabled environment.\nThe vulnerability represents a significant security risk to environments where log files are stored with insufficient access controls or are integrated into logging-as-a-service platforms, as these logs serve as a persistent repository for sensitive session identifiers.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the application's request processing layer to filter or sanitize input parameters before passing them to the logging subsystem. Specifically, when the Model Context Protocol (MCP) authentication process triggers, the system extracts tokens passed as URL query parameters during the initialization or verification phase.\nThe application logging mechanism consumes these request objects and serializes them into plaintext logs without inspecting the content for sensitive headers or query arguments. Because the tokens are transmitted in the query string, they are treated as standard request metadata and are persisted to the system logs.\nThe attack flow proceeds as follows: 1) An attacker monitors the application's logging infrastructure, such as standard output (stdout), log files stored on the filesystem, or remote centralized logging aggregators. 2) A legitimate user interacts with the OpenPanel application, causing the authentication process to generate a request containing a sensitive MCP token within the URL. 3) The application server logs the entire request URI, including the raw base64-encoded token, to the log files. 4) The attacker extracts the base64-encoded string from the log entries. 5) The attacker decodes and replays the captured token in a request to the MCP endpoint, effectively authenticating as the original user.\nThe vulnerable component is the request handling logic that interfaces with the logging utility. The exposure occurs regardless of whether the log is locally stored or shipped to a secondary management platform, assuming the attacker has permission to view logs at any point in the pipeline. Exploitation does not require elevated privileges on the primary application server, only sufficient read access to the logging stream. The post-exploitation impact includes unauthorized access to project analytics data and any other resources exposed through the MCP interface, potentially allowing for data exfiltration or manipulation of session-bound states."
}