Vulnerability Description
OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/Openpanel-dev/openpanel/commit/071c736c4539c005ac32647f2cfc6d
- https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-wfrw-rm3f-52
- https://www.vulncheck.com/advisories/openpanel-before-3.0.0-credential-disclosur
FAQ
What is CVE-2026-116819?
CVE-2026-116819 is a vulnerability with a CVSS score of 8.5 (HIGH). OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redact...
How severe is CVE-2026-116819?
CVE-2026-116819 has been rated HIGH with a CVSS base score of 8.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-116819?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.