CVE-2026-0767: Open WebUI Information Disclosure Flaw

CVE-2026-0767 Overview

CVE-2026-0767 is an information disclosure vulnerability in Open WebUI that transmits credentials in cleartext [CWE-319]. Network-adjacent attackers can intercept these credentials without authenticating to the application. The flaw resides in how the affected endpoint handles credential data submitted by clients. Open WebUI version 0.6.32 is affected according to the vendor data published in the National Vulnerability Database (NVD).

The Zero Day Initiative (ZDI) tracked this issue as ZDI-CAN-28259 and published advisory ZDI-26-033. Exploitation requires adjacency to the network path between client and server but does not require user interaction.

Critical Impact
Attackers positioned on adjacent networks can capture cleartext credentials in transit, enabling account takeover and follow-on compromise of Open WebUI instances and any reused credentials.

Affected Products

Open WebUI 0.6.32
Deployments exposing the affected credential endpoint over plaintext channels
Open WebUI instances reachable on shared or untrusted local networks

Discovery Timeline

2026-01-23 - CVE-2026-0767 published to NVD
2026-01-30 - Last updated in NVD database

Technical Details for CVE-2026-0767

Vulnerability Analysis

The vulnerability is classified under [CWE-319] Cleartext Transmission of Sensitive Information. Open WebUI accepts credentials at a specific endpoint and transmits those credentials without applying transport encryption to the sensitive fields. An attacker positioned on the same broadcast domain, an intermediate hop, or a misconfigured wireless segment can passively capture the credential material.

Because the issue is rooted in how the application handles credentials in transit, no authentication is required to weaponize it. The attacker only needs visibility into traffic flowing to or from the Open WebUI server. Once captured, credentials can be replayed against the same instance or tested against other services where users reuse passwords.

The Zero Day Initiative advisory ZDI-26-033 documents the technical details and confirms the impact is limited to confidentiality, with no direct effect on integrity or availability.

Root Cause

The root cause is the absence of enforced encryption for credential fields submitted to the vulnerable endpoint. Sensitive values traverse the network as plaintext that any on-path observer can read. Applications handling authentication material must terminate them only over encrypted channels and reject downgrade paths.

Attack Vector

The attack vector is Adjacent Network. An attacker on the same LAN, VLAN, or wireless segment as either the client or the Open WebUI server can perform passive sniffing or active man-in-the-middle techniques such as ARP spoofing. No privileges or user interaction are required, and the exploit produces no application-side error states.

No public proof-of-concept exploit is currently listed for CVE-2026-0767, and the EPSS data does not indicate active exploitation. Refer to the Zero Day Initiative Advisory ZDI-26-033 for the verified technical breakdown.

Detection Methods for CVE-2026-0767

Indicators of Compromise

HTTP requests to Open WebUI authentication endpoints observed on port 80 or other non-TLS listeners
Packet captures containing plaintext credential parameters destined for Open WebUI hosts
Successful Open WebUI logins originating from IP addresses that do not match historical user baselines

Detection Strategies

Inspect network flow logs for Open WebUI traffic that bypasses TLS termination or uses cleartext HTTP
Correlate authentication events from Open WebUI with concurrent ARP table changes or DHCP anomalies on the same segment
Hunt for credential reuse by matching Open WebUI usernames against authentication logs from federated identity providers

Monitoring Recommendations

Enable verbose access logging on the Open WebUI reverse proxy and forward logs to a centralized analytics platform
Alert on any inbound connection to Open WebUI that negotiates a non-TLS protocol
Monitor for sudden spikes in failed and successful login pairs that could indicate captured credential replay

How to Mitigate CVE-2026-0767

Immediate Actions Required

Place Open WebUI behind a reverse proxy that enforces HTTPS with a valid certificate and disables plaintext listeners
Restrict network access to Open WebUI to trusted management VLANs or VPN-only paths until a fixed version is deployed
Force a password reset for all Open WebUI users whose credentials may have traversed untrusted segments

Patch Information

No vendor patch URL is listed in the NVD record at the time of publication. Monitor the Zero Day Initiative Advisory ZDI-26-033 and the Open WebUI project release notes for an official fix, and upgrade beyond version 0.6.32 once a remediated build is available.

Workarounds

Terminate all Open WebUI traffic at a TLS-enabled reverse proxy such as Nginx, Caddy, or Traefik with HSTS enabled
Disable any HTTP listener on the Open WebUI service and bind only to localhost behind the proxy
Segment Open WebUI into a dedicated VLAN and require multi-factor authentication on upstream identity providers to limit credential replay value

bash

# Configuration example: enforce HTTPS-only access to Open WebUI via Nginx
server {
    listen 80;
    server_name openwebui.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name openwebui.example.com;

    ssl_certificate     /etc/ssl/certs/openwebui.crt;
    ssl_certificate_key /etc/ssl/private/openwebui.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto https;
    }
}