---
id: "CVE-2026-116819"
kind: "vulnerability"
aliases: ["CVE-2026-116819"]
title: "OpenPanel: read-only project members can see plaintext integration secrets"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["openpanel", "package", "self-hosted", "slack", "webhooks"]
not_affected_if: ["already-upgraded", "no-notification-integrations"]
published_at: "2026-10-27T00:17:16+00:00"
first_seen_at: "2026-10-27T00:25:55+00:00"
updated_at: "2026-10-27T00:26:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116819", "first_seen_at": "2026-10-27T00:25:55+00:00"}]
---

# OpenPanel: read-only project members can see plaintext integration secrets

OpenPanel before 3.0.0 returns notification integration secrets in plaintext from the notification.rules tRPC query because it skips the redaction step. A project member with read-level access can retrieve Slack bot tokens, webhook URLs and authorization headers and use them against external systems.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenPanel version in use; affected builds are below `3.0.0`.
- Review which accounts hold read-level access to projects that have Slack or webhook notification integrations.
- unknown whether the sources list a specific endpoint log or audit check.

## Fix

- Upgrade OpenPanel to `3.0.0` or later.
- Rotate any Slack bot tokens, webhook URLs and authorization headers that were stored in notification integrations and may have been exposed to read-level members.

## Timeline

- 2026-10-27T00:25:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116819

## From the sources

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_