rootpwn

medium · CVSS v3 3.3 · CVSS v4 4.8

CVE-2026-93982

OpenPanel writes Model Context Protocol authentication tokens from URL query parameters into plaintext application logs without redaction. A

Overview

OpenPanel writes Model Context Protocol authentication tokens from URL query parameters into plaintext application logs without redaction. Attackers with read access to stdout or centralized logging infrastructure can extract these base64-encoded credentials. This allows unauthorized replay of MCP requests to access sensitive project analytics.

Description

OpenPanel through commit bad75bdd writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and access project analytics.

Impact

This vulnerability impacts the confidentiality of Model Context Protocol sessions, leading to unauthorized data exposure of project analytics. Unauthorized entities with log access can impersonate legitimate clients by replaying captured tokens. Integrity and availability are not directly affected, but access controls are compromised.

Remediation

Update OpenPanel beyond commit bad75bdd or apply the vendor-supplied patch to ensure sensitive query parameters are redacted from logs. Restrict read access to application stdout and centralized logging systems using the principle of least privilege. Implement log monitoring to detect unauthorized access attempts and rotate exposed MCP credentials immediately.

Risk context

The vulnerability is rated as medium severity with a CVSS v3 score of 3.3 and a CVSS v4 score of 4.8. EPSS data is currently not available. Urgency is moderate, depending on whether log stores are exposed to unauthorized users.

Affected products

  • OpenPanel

Scores

Severity
medium
CVSS v2
1.7
CVSS v3
3.3
CVSS v4
4.8
EPSS
—

OpenPanel Information Disclosure Plaintext Logging Model Context Protocol Credential Exposure

← All CVEs

Related CVEs

medium

CVE-2026-89333

The Tutor LMS plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in versions up to and including 4.0.8. The flaw exists due to missing validation on the 'student_id' parameter. This allows authenticated attackers with subscriber-level access to harvest sensitive user information, including emails and phone numbers, by iterating through user IDs.

View analysis

medium

CVE-2026-89334

An authorization bypass vulnerability exists in the Better Messages WordPress plugin up to version 2.15.33 due to improper privilege verification. The flaw allows authenticated users with custom-level access or higher to read unauthorized chat transcripts, thread metadata, and user data. This occurs when specific default chat room settings remain unconfigured.

View analysis

medium

CVE-2026-91847

The Online Scheduling and Appointment Booking System WordPress plugin before version 28.2 fails to validate conversation ownership during unauthenticated AI booking-assistant actions. This flaw allows unauthenticated visitors to read and inject messages into other users' active conversations. It matters because it exposes private communications within the scheduling interface.

View analysis

medium

CVE-2026-92099

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 allows unauthenticated users to publish arbitrary GraphQL queries and claim aliases without authorization. This flaw lets attackers inject or modify persisted queries that the site’s frontend will later execute. It can lead to data leakage, query tampering, or denial of service.

View analysis