---
id: CVE-2026-116819
title: OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query
summary: >-
  OpenPanel before 3.0.0 contains an information disclosure vulnerability that
  allows read-level project members to obtain plaintext integration secrets
  because the notification.rules query skips redactIntegration. Attackers can
  call the n…
severity: high
cvss: 8.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-200
vendor: Openpanel-dev
product: openpanel
affected:
  - openpanel < 3.0.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T19:05:12.529344Z'
published: '2026-10-26'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T19:05:33.351Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116819'
references:
  - url: >-
      https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-wfrw-rm3f-52x8
    label: GitHub Security Advisory (GHSA-wfrw-rm3f-52x8)
  - url: >-
      https://github.com/Openpanel-dev/openpanel/commit/071c736c4539c005ac32647f2cfc6dec89cfb596
  - url: >-
      https://www.vulncheck.com/advisories/openpanel-before-3.0.0-credential-disclosure-via-notification-rules-query
    label: >-
      VulnCheck Advisory: OpenPanel before 3.0.0 Credential Disclosure via
      notification.rules Query
tags:
  - cve.org
epss: 0.00303
epssPercentile: 0.23187
ingestedAt: '2026-10-27T16:11:59.145Z'
---

## Overview

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems.

## Affected

- `openpanel < 3.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.