CVE-2026-57230 openreplay CVE debrief

Who should care

Users of OpenReplay session replay suite, especially those with multi-tenancy enabled, should be aware of this vulnerability and take steps to protect themselves. This includes updating to version 1.27.0 or later, restricting access to the session search and analytics API, and monitoring for suspicious activity on the ClickHouse tables.

Technical summary

The vulnerability in OpenReplay's session search and analytics API allows an authenticated member to read any ClickHouse table through blind boolean and time-based exfiltration and to break the project's session search for all viewers until the stored key is removed. This issue is fixed in version 1.27.0. The vulnerability has a CVSS score of 5.4 and is considered Medium severity. Affected product deployments should be identified in managed environments, and owners should be assigned for follow-up. The session search and analytics API in enterprise editions with multi-tenancy enabled built ClickHouse queries by inserting user input into the query string, including two positions that took input without escaping.

Defensive priority

Medium priority due to the CVSS score of 5.4 and the potential impact on session search and analytics.

Recommended defensive actions

• Update OpenReplay to version 1.27.0 or later
• Restrict access to the session search and analytics API
• Monitor for suspicious activity on the ClickHouse tables
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-10T21:16:59.450Z and has not been modified since then. The NVD entry is currently 5.4 (Medium). Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify the affected product deployments and review official advisories for further details.

Official resources