CVE-2026-93982

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-93982

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93982.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-93982

Aliases

GHSA-8wx6-g25r-2943

Published

2026-09-19T11:53:34Z

Modified

2026-10-04T02:47:16Z

Severity

4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext

Details

OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and access project analytics.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-532"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93982.json"
}

References

Affected packages

Git / github.com/openpanel-dev/openpanel

Affected ranges

Type

GIT

Repo

https://github.com/openpanel-dev/openpanel

Events

Introduced

Fixed

cd24bb838301df1a9087e2e132b344e5b8a99963

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "2.3.0"
        },
        {
            "fixed":  "2.3.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93982.json"