CVE-2026-116819

OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query

State: Published
Severity: 8.4 High
Published: Oct 26, 2026
Updated: Oct 26, 2026
Reserved: Oct 26, 2026

Description

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems.

Scores

CVSS	Score	Vector	Source
4.0	8.4 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N	VulnCheck
3.1	8.5 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N	VulnCheck

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
openpanelOpenpanel-dev	before 3.0.0Affected 3.0.0Not affected

References

GitHub Security Advisory (GHSA-wfrw-rm3f-52x8)vendor-advisory
https://github.com/Openpanel-dev/openpanel/commit/071c736c4539c005ac32647f2cfc6dec89cfb596patch
VulnCheck Advisory: OpenPanel before 3.0.0 Credential Disclosure via notification.rules Querythird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.