CVE-2026-0767: (0Day) Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability
Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Open WebUI. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of credentials provided to the endpoint. The issue results from transmitting sensitive information in plaintext. An attacker can leverage this vulnerability to disclose transmitted credentials, leading to further compromise. Was ZDI-CAN-28259.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0767?
CVE-2026-0767 is categorized as a critical information disclosure vulnerability.
How do I fix CVE-2026-0767?
To mitigate CVE-2026-0767, ensure that all sensitive data is transmitted over secure channels like HTTPS.
Who is affected by CVE-2026-0767?
CVE-2026-0767 affects installations of Open WebUI version 0.6.32 and below.
What type of vulnerability is CVE-2026-0767?
CVE-2026-0767 is an information disclosure vulnerability due to cleartext transmission of credentials.
Can CVE-2026-0767 be exploited remotely?
Yes, CVE-2026-0767 can be exploited by network-adjacent attackers to disclose sensitive information.