A new vulnerability in OpenPanel MCP can leave credentials in plain text logs, creating a less obvious but significant risk for teams connecting AI assistants to analytics data. The report is for CVE-2026-93982.
The vulnerability was found in the way OpenPanel MCP handles the access token when it is passed within the URL of a request. According to the security entry on GitHub, the request URL can be passed to the logging mechanism as is, without removing the token value.
See also: Google Home opens the door to Claude, OpenClaw and other MCP AI agents
What is OpenPanel MCP about?
OpenPanel offers a Model Context Protocol server so that applications like Claude can request data from analytics projects. The project documentation states that the token can be sent either as a token in the address or as an Authorization: Bearer header. The latter option does not expose the secret in the URL.
The issue affects OpenPanel versions up to commit bad75bddc74d12d36cfb843f4531d3b830a8d994, according to VulnCheck's analysis. The OpenPanel MCP implementation logs the request address and can thus store the token in application output, in container files, or in a central log collection platform.
In OpenPanel MCP, the token is not a random, permissionless identifier. The OpenPanel documentation describes a Base64-encoded string containing the client ID and its secret, separated by a colon. If someone gains access to the logs, they can try to reuse the data for MCP requests.
How can the report be used?
The OpenPanel MCP vulnerability is not considered a remote attack without prerequisites. It requires access to application output or a centralized log file system. However, this does not make it insignificant: these systems are often available to administrators, infrastructure providers, monitoring tools, and automated support services.
The CVE entry gives the issue a score of 3.3 with a CVSS of 3.1, while CVSS 4.0 rates it at 4.8. The numbers reflect the need for local access and the limited privileges of the attack, not the value of the data a token can protect. The publication was made on September 19, 2026.
The incident is part of a broader debate about the security of MCP servers. When a secret is passed along in the request address, it can appear not only in the application's files, but also in reverse proxies, request histories, debuggers, and backups. The same pattern has been observed in previous SecNews analyses of AI workflows.
See also: AI workflows may be creating a dangerous new authorization gap
The risk increases when data collectors keep history for a long time or when files are transferred to multiple services. Even without malicious access to the application, a copy left in a test environment can reveal active data. File lifecycle management is therefore part of the defense.
Restriction measures for administrators
For OpenPanel MCP, the most immediate action is to stop using tokens in URL parameters and prefer the Authorization: Bearer header. Administrators should check which version or commit is running, monitor project announcements for fixed versions, and restrict access to log files using the principle of least privilege.
At the same time, you need to search for URLs containing token= in logs, collectors, and cached snapshots. Simply hiding fields with names like “password” or “secret” is not enough, because the token is inside the entire URL string. The value must be replaced before logging, and already exposed tokens must be revoked and replaced.
For new connections, a client with read permissions and limited to a project is a safer choice than an account with organization-wide access. The SecNews technical team also recommends checking the permissions of log collectors and avoiding sending sensitive URLs to third-party services.
🔑 Secure your passwords with Proton Pass
Password manager from Proton — end-to-end encryption, passkeys, built-in 2FA, and monitoring for leaks of your credentials.
- ✔ Encrypted storage of passwords & passkeys
- ✔ Notification if any of your passwords are leaked (Dark Web Monitoring)
- ✔ Free version — on all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: CVE-2026-81315: DNS rebinding bypass in AshAi MCP
OpenPanel MCP and CVE-2026-93982 are reminders that protecting a token does not end with the service version. The transfer path, logging, storage, and revocation should be treated as a single chain. Until there is a clear fix, removing tokens from URLs and reviewing old logs are the most practical steps.
