CVE-2026-93983Disclosure

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-09-19); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Hugo | DevOps | Cybersecurity@HugoValters9d
Disclosure
CVE-2026-93983 OpenPanel SQLi: authenticated users inject boolean terms via ClickHouse property keys, bypassing project isolation. CVSS 5. Patch status unknown, treat as unpatched. Review filters and update now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-93983/ #OpenPanel #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The tweet discloses CVE-2026-93983 as an authenticated SQL injection in OpenPanel via ClickHouse property keys (CVSS 5), urges users to update filters, but provides no named patch, exploit code, or evidence of active exploitation, aligning with a disclosure classification.
0000041
1.1K followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-93983 OpenPanel through commit bad75bdd fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can sup… https://www.cve.org/CVERecord?id=CVE-2026-93983
Post summary
The tweet discloses CVE-2026-93983, stating that OpenPanel through commit bad75bdd does not escape property keys in ClickHouse SQL queries, enabling authenticated users to inject boolean SQL terms.
000001.4K
58.1K followersView on X

Explore more

Back to dashboard