CVE-2026-4994
CWE-200Published: March 28, 2026· Updated: Mar 30, 2026
Official Description
A vulnerability was found in wandb OpenUI up to 1.0/3.5-turb. Affected is the function generic_exception_handler of the file backend/openui/server.py of the component APIStatusError Handler. The manipulation of the argument key results in information exposure through error message. Access to the local network is required for this attack. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Technical Analysis
CVE-2026-4994 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.
Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
From a weakness classification perspective (CWE-200): Information exposure vulnerabilities leak sensitive data to unauthorized actors.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (4)
Quick Facts
Related CVEs (CWE-200)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-4994 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts