[ CVE-2026-116819 · Published 27 Oct 2026 ]
Vulnerability in Openpanel-dev openpanel
CVSS 8.5
EPSS <1%No fix listed yet
[ Description ]Official description
OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.