PT-2026-1997 · Openwebui+1 · Open-Webui

Brandon Niemczyk + 2 · Publicado 2026-01-09 · Atualizado 2026-01-23 · CVE-2026-0767

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open WebUI (affected versions not specified)

Description A flaw exists in Open WebUI that allows network-adjacent attackers to disclose sensitive information. The issue stems from transmitting credentials in plaintext through an unspecified endpoint. Authentication is not required for exploitation. Successful exploitation could lead to further compromise of the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2026-0767

ZDI-26-033

Produtos afetados

Open-Webui

Referências · 4

• https://osv.dev/vulnerability/CVE-2026-0767 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-26-033 · Nota de Segurança
• https://twitter.com/CVEnew/status/2014576954616562077 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-0767 · Nota de Segurança