Live › vulnerability › CVE-2026-116819
Go to dashboardOpenPanel before 3.0.0 returns notification integration secrets in plaintext from the notification.rules tRPC query because it skips the redaction step. A project member with read-level access can retrieve Slack bot tokens, webhook URLs and authorization headers and use them against external systems.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Teams that self-host OpenPanel below and have notification integrations (Slack bots, webhooks, authorization headers) configured in projects where some members hold only read access. Exposure depends on those secrets being stored in the integrations; instances without such integrations or already on are not affected.
3.0.03.0.0No product ranges from the sources yet.
3.0.0.3.0.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems.
This page as .md · .json · in your agent: get_signal("CVE-2026-116819")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.