CVE-2026-116819High· 8.5▾ TwilightOpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the n…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems.
openpanel < 3.0.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116805Medium· 4.3OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list
CVE-2026-88893High· 7.5OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers
CVE-2026-116813Medium· 6.5OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts
CVE-2026-116809Medium· 5.3OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure
CVE-2026-116818High· 8.2OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket
CVE-2026-116817Medium· 6.5OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board