Description

OpenPanel through commit bad75bdd fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.0",
  "pubDate": "2026-09-19T12:16:41.493Z",
  "pubdate": "2026-09-19T12:16:41.493Z",
  "executiveSummary": "OpenPanel, up to commit bad75bdd, contains a critical SQL injection vulnerability within its ClickHouse query processing engine.\nThe vulnerability arises from improper sanitization of property keys used in query filters, allowing an authenticated user to inject arbitrary boolean SQL terms.\nThis flaw effectively bypasses project isolation, enabling unauthorized access to sensitive metrics belonging to other projects within the system.\nThe risk implication is high, as it compromises data confidentiality across the multi-tenant environment.\nExploitation requires authenticated access to the platform; however, once authenticated, a user can craft malicious filter names to manipulate the underlying database queries without further elevated privileges.\nThe attack vector is limited to the application layer via malicious inputs that influence ClickHouse query construction.",
  "technicalDetails": "The root cause of this vulnerability is a failure to properly escape or parameterize property keys before they are incorporated into ClickHouse SQL queries within OpenPanel's backend logic.\nWhen a user supplies a filter name, the application directly embeds this input into the query string intended for the ClickHouse database, failing to distinguish between user-supplied data and query structure.\nAn authenticated attacker can exploit this by crafting a filter name containing boolean SQL operators (e.g., OR, AND) and other SQL syntax. By injecting these terms, the attacker alters the logic of the `WHERE` clause in the resulting query.\nThe attack flow follows a predictable sequence: First, the attacker identifies a functionality that utilizes filter names to query ClickHouse metrics. Second, the attacker crafts a malicious input string designed to terminate the intended query condition and inject a new one, such as 'property_name' = 'value' OR 1=1.\nBecause the input is not sanitized or parameterized, the ClickHouse engine executes the modified query as if it were legitimate. By manipulating the boolean logic, the attacker can force the database to return records associated with projects or metrics for which they lack authorization.\nThis circumvents the internal project isolation mechanisms that are supposed to enforce data scoping based on the authenticated user's permissions. The query returns aggregated metrics or event data that the user should not have visibility into, facilitating cross-tenant data exposure.\nThe vulnerability affects OpenPanel up to commit bad75bdd. The primary component involved is the database interaction layer responsible for generating ClickHouse queries based on user-provided filter names.\nThis is a post-authentication vulnerability, meaning an attacker must possess a valid user account. However, once authenticated, the lack of robust input validation or the use of dynamic string concatenation for query construction allows for the bypass of access controls."
}