CVE-2026-0767

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-0767

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-0767.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-0767

Published

2026-01-23T03:28:39.523Z

Modified

2026-07-08T08:12:39.874034162Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability

Details

Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Open WebUI. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of credentials provided to the endpoint. The issue results from transmitting sensitive information in plaintext. An attacker can leverage this vulnerability to disclose transmitted credentials, leading to further compromise. Was ZDI-CAN-28259.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "0.6.32"
                },
                {
                    "last_affected": "0.6.32"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0767.json",
    "cna_assigner": "zdi",
    "cwe_ids": [
        "CWE-319"
    ]
}

References

Affected packages

Git / github.com/open-webui/open-webui

Affected ranges

Type

GIT

Repo

https://github.com/open-webui/open-webui

Events

Introduced

37d1c85c996e1bdcd505e1e6d62b2f17acd8df23

Last affected

37d1c85c996e1bdcd505e1e6d62b2f17acd8df23

Database specific

{
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:openwebui:open_webui:0.6.32:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.6.32"
        },
        {
            "last_affected": "0.6.32"
        }
    ]
}

Affected versions

0.*

0.6.32

v0.*

v0.6.32

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-0767.json"