CVE-2026-116819GHSA-wfrw-rm3f-52x8
OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query
Openpanel-dev openpanel
CVSS
8.4HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 3.0.0openpanelCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems.
Text from CVE List
Affected versions 2
- openpanelaffected: all versions before 3.0.0CVE List
- openpanelunaffected: 3.0.0CVE List
References 3
- github.com/Openpanel-dev/openpanel/commit/071c736c4539c005ac32647f2cfc6dec89cfb596Fixvia CVE List
- github.com/Openpanel-dev/openpanel/security/advisories/GHSA-wfrw-rm3f-52x8Advisoryvia CVE List
- vulncheck.com/advisories/openpanel-before-3.0.0-credential-disclosure-via-notification-rules-queryAdvisoryvia CVE List