CVE-2026-116819
OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level…
- Risk score
- 51/100
- CVSS
- 8.5 v3.1
- Published
- 27 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and autho…
- Affected
- See advisory
- Fix
- Upgrade the product to 3.0.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.5 high
References
Original description
OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems.
Last activity 27 Oct 2026. Patch Forecast updates every hour.