Information Disclosure in OpenPanel by OpenPanel Dev

CVE-2026-116819

What is CVE-2026-116819?

OpenPanel, prior to version 3.0.0, is vulnerable to an information disclosure flaw that permits read-level project members to access sensitive integration secrets. This flaw occurs because the query 'notification.rules' lacks protection against disclosing critical information. Malicious attackers could exploit this vulnerability by invoking the notification.rules tRPC query, thus revealing Slack bot tokens, webhook URLs, and authorization headers. Such breaches could potentially lead to unauthorized access to external systems, posing a significant risk to data security.

References