A flaw in the generic_exception_handler function of wandb OpenUI’s backend/openui/server.py allows an attacker to manipulate the argument key and trigger detailed error messages that expose internal information. The vulnerability is classified as CWE-200 and CWE-209 and has a CVSS score of 5.1, indicating moderate severity. When exploited, it can reveal configuration details, stack traces or other sensitive data that may be leveraged to further compromise the system.

The affected product is wandb OpenUI, versions up to 1.0 and 3.5-turb. The issue resides in the backend component that handles API status errors and is exposed to any local client that can interact with the API.

The exploit is publicly disclosed and requires the attacker to have access to the same local network as the target. While the CVSS score shows moderate risk, the lack of an EPSS score and absence from the KEV list suggests that widespread exploitation has not yet been observed. Nevertheless, because the payload is readily available, any host that accepts local API traffic is considered at risk for accidental or malicious information leakage. The primary attack vector is the manipulation of request parameters over the local network connection to the OpenUI service.