CVE-2026-93982

Name of the Vulnerable Software and Affected Versions OpenPanel versions prior to commit bad75bdd

Description The software writes Model Context Protocol (MCP) authentication tokens, which are passed via URL query parameters, into plaintext application logs without redaction. This allows attackers who have access to application stdout or centralized logging systems to capture base64-encoded credentials. These captured credentials can be used to replay MCP requests and gain unauthorized access to project analytics.

Recommendations Update OpenPanel to a version incorporating commit bad75bdd or later.