CVE-2026-116819 Details

A vulnerability allowing information disclosure exists in OpenPanel versions prior to 3.0.0. This issue enables read-level project members to access plaintext integration secrets, such as Slack bot tokens, webhook URLs, and authorization headers. The vulnerability arises because the 'notification.rules' tRPC query does not apply the necessary redaction to integration data. As a result, sensitive credentials can be retrieved and potentially misused against external systems.

The vulnerability can be addressed by applying the 'redactIntegration' function to all integration objects returned by the 'notification.rules' query, ensuring that sensitive information is properly concealed. Additionally, integrating encryption for secret fields at rest would prevent plaintext exposure in case of a missed redaction.