# CVE-2026-116819: OpenPanel information disclosure in notification rules

Source: https://junglewise.ai/threats/cve-2026-116819-openpanel-before-3-0-0-contains-an-information-disclosure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116819 · Severity: high · CVSS 8.5 · Published 2026-10-27

OpenPanel is an analytics platform that stores integration secrets like Slack bot tokens and webhook URLs. A vulnerability allows read-level project members to retrieve these plaintext secrets by calling the notification.rules query, gaining unauthorized access to external systems like Slack that are connected to the organization.

## Quick answers

**Is CVE-2026-116819 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116819 being exploited in the wild.

**How severe is CVE-2026-116819?** High severity, with a CVSS score of 8.5, published 27 October 2026.

**Which products and versions are affected?** OpenPanel before 3.0.0.

**Is there a fix for CVE-2026-116819?** Yes: fixed in 3.0.0. Until then: Restrict project membership to only trusted users who require read access; prefer write/admin-level roles for users who need integration configuration visibility until you upgrade. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116819 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-116819?** Check whether you run OpenPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.0.0

Restrict project membership to only trusted users who require read access; prefer write/admin-level roles for users who need integration configuration visibility until you upgrade.

## Technical details

The notification.rules tRPC query fails to redact integration secrets before returning integration objects to read-level members, bypassing the redact-on-read invariant enforced by integration.get and integration.list. The vulnerability exists because notification.rules is a protectedProcedure gated only at the read access level yet eagerly loads and spreads raw integration rows containing plaintext Slack tokens, webhook URLs, and authorization headers. An attacker with read-level project membership can call this query to retrieve credentials intended only for write/admin-level users.

## Affected products

- OpenPanel before 3.0.0

## Timeline

- 2026-10-11: disclosed: Advisory GHSA-wfrw-rm3f-52x8 published by maintainer
- 2026-09-21: patched: Fix committed (redact every integration read path)
- 2026-10-27: advisory: CVE-2026-116819 assigned

## References

- [https://github.com/Openpanel-dev/openpanel/commit/071c736c4539c005ac32647f2cfc6dec89cfb596](https://github.com/Openpanel-dev/openpanel/commit/071c736c4539c005ac32647f2cfc6dec89cfb596)
- [https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-wfrw-rm3f-52x8](https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-wfrw-rm3f-52x8)