CVE-2026-4994

CVE-2026-4994 identifies an information exposure vulnerability in wandb OpenUI versions up to 1.0/3.5-turb, specifically within the APIStatusError Handler's generic_exception_handler function. This flaw allows for the exposure of sensitive information through error messages by manipulating an argument key. Exploitation requires local network access and low privileges, resulting in a CVSS score of 3.5 (LOW). Although the exploit has been made public, there is no evidence of active exploitation, nor are there known Metasploit, Nuclei, or ExploitDB modules available. Community discussion is minimal, and the EPSS score is very low, indicating a low probability of exploitation despite the vendor's unresponsiveness to early disclosure.