CVE-2026-116819: OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query
OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems.
Affected Software
Event History
Frequently Asked Questions
Who can retrieve the exposed integration credentials?
Any project member with read-level access can call the notification.rules tRPC query. The issue does not require user interaction, but it does require low-privilege project access.
What types of secrets may be exposed, and what could they be used for?
The query can return plaintext Slack bot tokens, webhook URLs, and authorization headers that should have been redacted. An attacker could use those credentials against the associated external systems.
Which deployments are affected?
OpenPanel versions before 3.0.0 are affected. Deployments running 3.0.0 or later are not identified as affected by the provided information.