CVE-2026-116819

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems.

CVSS 4.0

8.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

CVSS 3.1

8.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

CWE

CWE-200

Published

2026-10-26

Modified

2026-10-26

Record from

the CVE List, synced 2026-10-26

Affected

• openpanel-dev:openpanel

References

• https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-wfrw-rm3f-52x8
• https://github.com/Openpanel-dev/openpanel/commit/071c736c4539c005ac32647f2cfc6dec89cfb596
• https://www.vulncheck.com/advisories/openpanel-before-3.0.0-credential-disclosure-via-notification-rules-query

Check your stackJSON