CVE-2026-93982: OpenPanel writes MCP auth tokens from URL query strings into plaintext logs

NVD·low signalXBlueskyLinkedInCopy link

Published 2026-09-19 and scored 3.3 LOW on CVSS v3.1, OpenPanel through commit bad75bdd logs Model Context Protocol authentication tokens taken from URL query parameters without redaction. Anyone with access to application stdout or a centralized logging pipeline can lift the base64 credentials and replay MCP requests against project analytics. Low severity, but a useful reminder that putting an MCP token in a query parameter means it lands in every log shipper, proxy access log and crash report downstream.