PT-2026-28711 · Wandb · Wandb/Openui

Eric-B + 1 · Publicado 2026-03-28 · Atualizado 2026-03-28 · CVE-2026-4993

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions wandb OpenUI versions up to 0.0.0.0/1.0

Description A security issue exists in wandb OpenUI related to hard-coded credentials. The manipulation of the LITELLM MASTER KEY argument within the file backend/openui/config.py can lead to exposure of these credentials. The exploit is publicly available and requires local access to initiate an attack. The vendor was informed of this issue but did not respond.

Recommendations Versions prior to 0.0.0.0/1.0 should be updated. As a temporary workaround, consider restricting access to the backend/openui/config.py file to minimize the risk of exploitation.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

CWE-259

Identificadores relacionados

CVE-2026-4993

Produtos afetados

Wandb/Openui

Referências · 6

• 🔥 https://gist.github.com/YLChen-007/3bf37486022d4c57caec3a35cd79ac92 · Exploit
• https://vuldb.com/?id.353880 · Nota
• https://vuldb.com/?ctiid.353880 · Nota
• https://twitter.com/CVEarity/status/2037940417132736913 · Publicação no Twitter
• https://vuldb.com/?submit.778265 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4993 · Nota de Segurança