Is CVE-2026-116819 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116819 being exploited in the wild.

How severe is CVE-2026-116819?

High severity, with a CVSS score of 8.5, published 27 October 2026.

How is CVE-2026-116819 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-116819?

Check whether you run OpenPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116819: OpenPanel information disclosure in notification rules

CVE-2026-116819 · Severity: high · CVSS 8.5 · Published 2026-10-27

OpenPanel is an analytics platform that stores integration secrets like Slack bot tokens and webhook URLs. A vulnerability allows read-level project members to retrieve these plaintext secrets by calling the notification.rules query, gaining unauthorized access to external systems like Slack that are connected to the organization.

Quick answers

Is CVE-2026-116819 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116819 being exploited in the wild.
How severe is CVE-2026-116819?: High severity, with a CVSS score of 8.5, published 27 October 2026.
Which products and versions are affected?: OpenPanel before 3.0.0.
Is there a fix for CVE-2026-116819?: Yes: fixed in 3.0.0. Until then: Restrict project membership to only trusted users who require read access; prefer write/admin-level roles for users who need integration configuration visibility until you upgrade. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116819 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-116819?: Check whether you run OpenPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.0.0

Restrict project membership to only trusted users who require read access; prefer write/admin-level roles for users who need integration configuration visibility until you upgrade.

Technical details

The notification.rules tRPC query fails to redact integration secrets before returning integration objects to read-level members, bypassing the redact-on-read invariant enforced by integration.get and integration.list. The vulnerability exists because notification.rules is a protectedProcedure gated only at the read access level yet eagerly loads and spreads raw integration rows containing plaintext Slack tokens, webhook URLs, and authorization headers. An attacker with read-level project membership can call this query to retrieve credentials intended only for write/admin-level users.

Affected products

OpenPanel before 3.0.0

Timeline

2026-10-11: disclosed: Advisory GHSA-wfrw-rm3f-52x8 published by maintainer
2026-09-21: patched: Fix committed (redact every integration read path)
2026-10-27: advisory: CVE-2026-116819 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.