CVE-2026-0767

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0767", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "REJECTED", "assignerShortName": "zdi", "dateReserved": "2026-01-08T22:50:10.918Z", "datePublished": "2026-01-23T03:28:39.523Z", "dateUpdated": "2026-09-02T17:34:15.123Z", "dateRejected": "2026-09-02T17:27:29.647Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-09-02T17:34:15.123Z"}, "rejectedReasons": [{"lang": "en", "value": "Open WebU's investigation showed that this describes the behavior of plain HTTP rather than a defect in the product. TLS termination is the operator's deployment decision, as it is for any backend that speaks HTTP, and not a security issue. https://docs.openwebui.com/security/vendor-dispositions/cve-2026-0767", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Open WebU's investigation showed that this describes the behavior of plain HTTP rather than a defect in the product. TLS termination is the operator's deployment decision, as it is for any backend that speaks HTTP, and not a security issue. https://docs.openwebui.com/security/vendor-dispositions/cve-2026-0767"}]}], "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0767", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-23T16:33:42.787569Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T16:33:47.579Z"}}], "cna": {"title": "Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability", "source": {"lang": "en", "value": "Peter Girnus (@gothburz), Brandon Niemczyk of Trend Zero Day Initiative"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "Open WebUI", "product": "Open WebUI", "versions": [{"status": "affected", "version": "0.6.32"}], "defaultStatus": "unknown"}], "datePublic": "2026-01-09T16:36:36.010Z", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-033/", "name": "ZDI-26-033", "tags": ["x_research-advisory"]}], "dateAssigned": "2026-01-08T22:50:10.942Z", "descriptions": [{"lang": "en", "value": "Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Open WebUI. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of credentials provided to the endpoint. The issue results from transmitting sensitive information in plaintext. An attacker can leverage this vulnerability to disclose transmitted credentials, leading to further compromise. Was ZDI-CAN-28259."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-319", "description": "CWE-319: Cleartext Transmission of Sensitive Information"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-01-23T03:28:39.523Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0767", "state": "PUBLISHED", "dateUpdated": "2026-01-23T16:33:51.687Z", "dateReserved": "2026-01-08T22:50:10.918Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2026-01-23T03:28:39.523Z", "assignerShortName": "zdi"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Rejected reason: Open WebU's investigation showed that this describes the behavior of plain HTTP rather than a defect in the product. TLS termination is the operator's deployment decision, as it is for any backend that speaks HTTP, and not a security issue. https://docs.openwebui.com/security/vendor-dispositions/cve-2026-0767"}], "id": "CVE-2026-0767", "lastModified": "2026-09-02T18:19:00.897", "metrics": {}, "published": "2026-01-23T04:16:03.660", "references": [], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Rejected"}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T03:16:57.386813+00:00", "value": {"mitigation_remediation": ["Verify whether a newer Open WebUI release contains a fix that encrypts credential transmission; if available, upgrade to that version.", "Limit network access to the credential endpoint with firewall rules or network segmentation so only trusted hosts can reach it.", "Enforce encrypted transport (HTTPS/TLS) for all authentication traffic, ensuring that the endpoint does not accept cleartext requests over unencrypted connections."], "summary": {"action": "Assess", "impact": "Information Disclosure via Unencrypted Credential Transmission"}, "threat_synthesis": {"affected_systems": "The affected product is Open WebUI version 0.6.32. No other versions were explicitly listed in the CNA data.", "description_and_impact": "This vulnerability arises when Open WebUI transmits credentials in cleartext to the exposed endpoint. An attacker who can observe traffic on the same network segment can capture those credentials without requiring authentication, potentially enabling further compromise of the target system.", "risk_and_exploitability": "The CVSS score of 6.5 reflects a moderate severity vulnerability, and the EPSS score of less than 1% indicates a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network\u2011adjacent attacker who can sniff traffic to the vulnerable endpoint; no credentials are needed to trigger the disclosure."}}}}, "created": "2026-01-23T10:26:43.887351+00:00", "updated": "2026-04-18T03:30:25.900515+00:00", "vendors": ["open-webui", "open-webui$PRODUCT$open-webui"]}