CVE-2026-93982
LOWCVSS 3.3Description
OpenPanel through commit bad75bdd writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and access project analytics.
Timeline
Published:September 19th, 2026 12:16 PM
Last modified:September 22nd, 2026 8:43 PM
CVSS Scoring
CVSS v3: 3.3 (LOW)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
Source: NIST NVD · Data may lag official sources by up to one minute