What is CVE-2026-0767?

CVE-2026-0767 is a medium-severity vulnerability in Open Webui, classified under Cleartext Transmission of Sensitive Information. CVSS score: 6.5/10. Published 2026-01-23.

How severe is CVE-2026-0767?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Open Webui

CVE-2026-0767

Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Open WebUI. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of credentials provided to the endpoint. The issue results from transmitting sensitive information in plaintext. An attacker can leverage this vulnerability to disclose transmitted credentials, leading to further compromise. Was ZDI-CAN-28259.

EPSS: 0.002 (15.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Open Webui — versions 0.6.32
Openwebui Open_webui — versions 0.6.32

Weakness classification (CWE)

CWE-319 — Cleartext Transmission of Sensitive Information

References

zdi-disclosures@trendmicro.com (x_research-advisory, Third Party Advisory)

Frequently asked questions

What is CVE-2026-0767?: CVE-2026-0767 is a medium-severity vulnerability in Open Webui, classified under Cleartext Transmission of Sensitive Information. CVSS score: 6.5/10. Published 2026-01-23.
How severe is CVE-2026-0767?: Medium severity. CVSS v3 base score is 6.5 out of 10.