CVE-2026-116819

Name of the Vulnerable Software and Affected Versions OpenPanel versions prior to 3.0.0

Description An information disclosure issue exists where project members with read-level access can obtain plaintext integration secrets. This occurs because the notification.rules tRPC query fails to execute the redactIntegration function. An attacker can utilize the notification.rules query to retrieve sensitive data, including Slack bot tokens, webhook URLs, and authorization headers, which can then be used against external systems.

Recommendations Update to version 3.0.0 or later. As a temporary mitigation, restrict read-level access to project members who do not require it.