Is there a patch available for CVE-2026-34091?

Yes, a patch is available for CVE-2026-34091. Update the affected software to the latest version immediately.

MediaWiki CVE-2026-34091

Q: What is the CVSS score of CVE-2026-34091?

CVE-2026-34091 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29063 MEDIUM

Information Exposure (CWE-200)

2026-05-11 wikimedia-foundation

GHSA-7gvw-7r69-cgx7

Information Disclosure Mediawiki Wikimedia Foundation

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 11, 2026 - 18:01 vuln.today

Patch available

May 11, 2026 - 17:01 EUVD

CVSS changed

May 11, 2026 - 16:22 NVD

5.5 (MEDIUM)

CVE Published

May 11, 2026 - 14:55 nvd

MEDIUM 5.5

CVE Published

May 11, 2026 - 14:55 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

AnalysisAI

Exposure of sensitive information in Wikimedia Foundation MediaWiki allows remote unauthenticated attackers to access unauthorized data via network requests against affected versions before 1.43.7, 1.44.4, and 1.45.2. The vulnerability has low confidentiality impact with CVSS 5.5 and evidence of proof-of-concept code, though no active exploitation in CISA KEV has been confirmed at time of analysis.

Technical ContextAI

This is an information disclosure vulnerability (CWE-200) in MediaWiki, the open-source wiki software powering Wikipedia and thousands of other wikis worldwide. The vulnerability affects the core MediaWiki application across multiple maintenance branches: the 1.43.x line (before 1.43.7), 1.44.x line (before 1.44.4), and 1.45.x line (before 1.45.2). The network-accessible nature (AV:N) combined with low attack complexity (AC:L) and no privilege or user interaction requirements (PR:N, UI:N) indicates the flaw exists in a standard MediaWiki request handler or API endpoint that processes unauthenticated input. CWE-200 classification confirms the root cause is improper access control or information leakage mechanisms rather than code execution or authentication bypass.

RemediationAI

Upgrade to the patched versions immediately: MediaWiki 1.43.7, 1.44.4, or 1.45.2 depending on your current branch. Vendors have released patches available from the Wikimedia Foundation; administrators should prioritize upgrading based on their maintenance branch. If immediate patching is not feasible, implement network-level access controls to restrict MediaWiki access to trusted networks or IP ranges, though this does not eliminate the vulnerability for internal users. Audit access logs for the affected endpoint referenced in Phabricator task T411305 to detect potential information disclosure. Review any sensitive data previously exposed through this vulnerability and consider notifying affected users if personal information was accessible.