CVE-2026-4994
wandb OpenUI APIStatusError server.py generic_exception_handler information exposure
- State
- Published
- Severity
- 5.1 Medium
- Published
- Mar 28, 2026
- Updated
- Mar 30, 2026
- Reserved
- Mar 27, 2026
Description
A vulnerability was found in wandb OpenUI up to 1.0/3.5-turb. Affected is the function generic_exception_handler of the file backend/openui/server.py of the component APIStatusError Handler. The manipulation of the argument key results in information exposure through error message. Access to the local network is required for this attack. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 3.5 Low | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 3.5 Low | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 2.7 Low | AV:A/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
OpenUIwandb |
|
References
- VDB-353881 | wandb OpenUI APIStatusError server.py generic_exception_handler information exposurevdb-entrytechnical-description
- VDB-353881 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #778266 | Weights and Biases OpenUI <= 1.0 (commit f9d8f0e) Generation of Error Message Containing Sensitive Information (CWE-209)third-party-advisory
- https://gist.github.com/YLChen-007/8c6ff147186855e4b716e7526de213e1exploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.