CVE-2026-116819

8.5 HIGHpublic exploit available

Published 2026-10-27 · Updated 2026-10-27

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Weaknesses

CWE-200

Public exploit & PoC references

https://github.com/Openpanel-dev/openpanel/commit/071c736c4539c005ac32647f2cfc6dec89cfb596
https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-wfrw-rm3f-52x8

All references

https://github.com/Openpanel-dev/openpanel/commit/071c736c4539c005ac32647f2cfc6dec89cfb596
https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-wfrw-rm3f-52x8
https://www.vulncheck.com/advisories/openpanel-before-3.0.0-credential-disclosure-via-notification-rules-query

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2013-10077PoC
MEDIUMCVE-2026-100149PoC
HIGHCVE-2026-100241
HIGHCVE-2026-100244
MEDIUMCVE-2026-100286
UNSCOREDCVE-2026-100377
UNSCOREDCVE-2026-100379PoC
UNSCOREDCVE-2026-100406PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.