Vulnerability · Published Mar 28, 2026 · Assigned by VulDB

CVE-2026-4994wandb OpenUI APIStatusError server.py generic_exception_handler information exposure

Low 3.5

In plain English

A low-severity information exposure in OpenUI from wandb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.2%top 89.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in wandb OpenUI up to 1.0/3.5-turb. Affected is the function generic_exception_handler of the file backend/openui/server.py of the component APIStatusError Handler. The manipulation of the argument key results in information exposure through error message. Access to the local network is required for this attack. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
wandb	OpenUI	1.03.5-turb

Weakness: CWE-209, CWE-200 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References

VDB-353881 | wandb OpenUI APIStatusError server.py generic_exception_handler information exposure vdb-entry, technical-description
VDB-353881 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #778266 | Weights and Biases OpenUI <= 1.0 (commit f9d8f0e) Generation of Error Message Containing Sensitive Information (CWE-209) third-party-advisory
https://gist.github.com/YLChen-007/8c6ff147186855e4b716e7526de213e1 exploit