PT-2026-28712 · Weights & Biases · Wandb/Openui

Eric-B + 1 · Published 2026-03-28 · Updated 2026-03-28 · CVE-2026-4994

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions wandb OpenUI versions up to 1.0/3.5-turb

Description A flaw exists in wandb OpenUI that allows information disclosure through error messages. The issue is located in the generic exception handler function within the backend/openui/server.py file, specifically related to the manipulation of the key argument. Local network access is required for exploitation. The exploit has been publicly released. The vendor was notified but did not respond.

Recommendations Versions prior to 1.0/3.5-turb should be used.

Exploit

Fix

Information Disclosure

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-200

CWE-209

Related Identifiers

CVE-2026-4994

Affected Products

Wandb/Openui

References · 6

• 🔥 https://gist.github.com/YLChen-007/8c6ff147186855e4b716e7526de213e1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4994 · Security Note
• https://vuldb.com/?ctiid.353881 · Note
• https://vuldb.com/?id.353881 · Note
• https://twitter.com/CVEarity/status/2037943194701430967 · Twitter Post
• https://vuldb.com/?submit.778266 · Note