Which versions of Openui are affected by CVE-2026-4993?

CVE-2026-4993 is a low-severity vulnerability in wandb OpenUI (CVSS 1.9). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.

Is there a public PoC exploit available for CVE-2026-4993?

Yes, a public proof-of-concept exploit is available for CVE-2026-4993. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4993?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Openui CVE-2026-4993

Q: What is the CVSS score of CVE-2026-4993?

CVE-2026-4993 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16913 LOW

Use of Hard-coded Credentials (CWE-798)

2026-03-28 VulDB

Authentication Bypass Openui Wandb

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 28, 2026 - 09:30 euvd

EUVD-2026-16913

Analysis Generated

Mar 28, 2026 - 09:30 vuln.today

CVE Published

Mar 28, 2026 - 09:15 nvd

LOW 1.9

DescriptionCVE.org

A vulnerability has been found in wandb OpenUI up to 0.0.0.0/1.0. This impacts an unknown function of the file backend/openui/config.py. The manipulation of the argument LITELLM_MASTER_KEY leads to hard-coded credentials. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Wandb OpenUI up to version 1.0 contains hard-coded credentials exposure in backend/openui/config.py where the LITELLM_MASTER_KEY argument is improperly handled, allowing local authenticated users with low privileges to read sensitive authentication material. The vulnerability has a low CVSS score (3.3) due to local-only attack vector and low impact scope, but publicly available exploit code exists and vendor contact has been unsuccessful, increasing practical risk for deployed instances.

Technical ContextAI

The vulnerability stems from improper secrets management in OpenUI's configuration layer (CWE-798: Use of Hard-coded Credentials). The LITELLM_MASTER_KEY parameter, which should be a sensitive authentication token for LiteLLM API interactions, is being stored or handled in a way that exposes it to local file system access or process memory inspection. OpenUI is a wandb-integrated tool for UI generation and backend configuration, making the config.py file a critical attack surface. The flaw exists across wandb OpenUI versions up to and including 1.0, with no explicit version cutoff indicating remediation.

RemediationAI

No vendor-released patch identified at time of analysis. Immediate workarounds include: (1) restrict local system access to OpenUI deployment environments using OS-level permissions and user isolation, (2) avoid storing LITELLM_MASTER_KEY in config.py or other checked-in files-use environment variables or secure secrets management systems (e.g., AWS Secrets Manager, HashiCorp Vault) instead, (3) implement file integrity monitoring on backend/openui/config.py to detect unauthorized access, and (4) rotate all LiteLLM credentials if local compromise is suspected. Monitor the wandb GitHub repository and VulDB references (https://vuldb.com/?id.353880) for eventual vendor response or community-maintained patches.