PT-2026-28711 · Wandb · Wandb/Openui

Eric-B + 1 · Published 2026-03-28 · Updated 2026-03-28 · CVE-2026-4993

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions wandb OpenUI versions up to 0.0.0.0/1.0

Description A security issue exists in wandb OpenUI related to hard-coded credentials. The manipulation of the LITELLM MASTER KEY argument within the file backend/openui/config.py can lead to exposure of these credentials. The exploit is publicly available and requires local access to initiate an attack. The vendor was informed of this issue but did not respond.

Recommendations Versions prior to 0.0.0.0/1.0 should be updated. As a temporary workaround, consider restricting access to the backend/openui/config.py file to minimize the risk of exploitation.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-259

Related Identifiers

CVE-2026-4993

Affected Products

Wandb/Openui

References · 6

• 🔥 https://gist.github.com/YLChen-007/3bf37486022d4c57caec3a35cd79ac92 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4993 · Security Note
• https://vuldb.com/?id.353880 · Note
• https://vuldb.com/?ctiid.353880 · Note
• https://twitter.com/CVEarity/status/2037940417132736913 · Twitter Post
• https://vuldb.com/?submit.778265 · Note