The vulnerability occurs when the LITELLM_MASTER_KEY argument in wandb OpenUI’s config.py is manipulated, causing the application to store hard‑coded credentials that can be retrieved by a local attacker. This leads to a loss of confidentiality and the potential for local privilege escalation or unauthorized access to the service. The weakness is captured by CWE-259 (Hard‑coded Password) and CWE-798 (Use of Hard‑coded Credentials). The disclosed exploit is available to the public, and the vendor has not addressed it publicly.

The affected product is wandb OpenUI. Versions up to and including 0.0.0.0/1.0 are impacted. No patch or upgrade path is currently available from the vendor.

The CVSS score of 4.8 indicates a medium severity problem. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the attack requires local access to the machine running the service and the vendor has not released a fix, the risk is limited to environments where the OpenUI component is exposed to potentially compromised local users or processes. The known exploit can be executed without additional external manipulation, and the lack of a remediation reduces the time window for detection to the interval between the disclosure and any future vendor response.