Vulnerability · Published Oct 26, 2026 · Assigned by VulnCheck

CVE-2026-116819OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query

High 8.5

In plain English

A high-severity information exposure in openpanel from Openpanel-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)8.5High

Exploit odds (30 days)0.3%top 76.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems.

Affected products (as reported)

Vendor	Product	Versions
Openpanel-dev	openpanel	0 – before 3.0.0

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

References

GitHub Security Advisory (GHSA-wfrw-rm3f-52x8) vendor-advisory
https://github.com/Openpanel-dev/openpanel/commit/071c736c4539c005ac32647f2cfc6dec89cfb596 patch
VulnCheck Advisory: OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query third-party-advisory