What happened
NVD published this CVSS 3.3 Low vulnerability on Sept 19, 2026, describing plaintext credential logging in OpenPanel's MCP integration.
Why it matters
Credential logging is a common but underestimated risk pattern in MCP integrations — a low-CVSS flaw here still creates a durable, low-effort path to MCP token theft for anyone with routine log access, not just external attackers.
Attack vector
MCP authentication tokens passed as URL query parameters are written to plaintext application logs without redaction; anyone with access to stdout or centralized logging can capture base64-encoded credentials and replay MCP requests.
Affected systems
OpenPanel through commit bad75bdd
Mitigation
Apply the fix in GitHub Security Advisory GHSA-8wx6-g25r-2943; redact query-parameter tokens from logs and rotate any potentially exposed MCP credentials.