OpenPanel - Unauthenticated Bull Board Queue Dashboard

mediumseverity

6.5CVSS score

0.6%likelihood of exploitation, next 30 days

47%of all CVEs are less likely

Readycheck to confirm it

OpenPanel before 3.0.0 contains a broken authentication vulnerability caused by missing authentication on the Bull Board dashboard served on the worker HTTP port, letting unauthenticated attackers access and modify queue data and jobs, exploit requires no authentication.

Impact

Unauthenticated attackers can access and modify job queues, potentially disrupting operations and accessing sensitive queue data.

Fix

Update to version 3.0.0 or later.

How to confirm it

Send: GET {{BaseURL}}/api/queues
Positive when: status 200 AND contains "\"readOnlyMode\"" and "\"allowRetries\"" and "\"isPaused\""

Run it with nuclei: nuclei -id CVE-2026-116817 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-116817

info:
  name: OpenPanel - Unauthenticated Bull Board Queue Dashboard
  author: kosoyyagent
  severity: medium
  description: |
    OpenPanel before 3.0.0 contains a broken authentication vulnerability caused by missing authentication on the Bull Board dashboard served on the worker HTTP port, letting unauthenticated attackers access and modify queue data and jobs, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can access and modify job queues, potentially disrupting operations and accessing sensitive queue data.
  remediation: |
    Update to version 3.0.0 or later.
  reference:
    - https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-r627-6vrh-65p9
    - https://github.com/Openpanel-dev/openpanel/commit/193e1e3ae01aa5208b3bee754ddee2c7ce33b38d
    - https://nvd.nist.gov/vuln/detail/CVE-2026-116817
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    cve-id: CVE-2026-116817
    epss-score: 0.00565
    epss-percentile: 0.47294
    cwe-id: CWE-306
  metadata:
    max-request: 1
    vendor: openpanel
    product: openpanel
    shodan-query: title:"Bull Dashboard"
    fofa-query: title="Bull Dashboard"
  tags: cve,cve2026,openpanel,exposure,bullboard,unauth,misconfig

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/queues"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - '"readOnlyMode"'
          - '"allowRetries"'
          - '"isPaused"'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from