CVE-2026-0767

CVE-2026-0767

published January 23, 2026

CVSS
5.3
EPSS
0%
Percentile
16.6
In the wild
Unconfirmed
What it is

Rejected reason: Open WebU's investigation showed that this describes the behavior of plain HTTP rather than a defect in the product. TLS termination is the operator's deployment decision, as it is for any backend that speaks HTTP, and not a security issue. https://docs.openwebui.com/security/vendor-dispositions/cve-2026-0767

The record
Technical detail
CVSS
5.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00253 · 16.6th percentile
Published
2026-01-23T09:16Z
EPSS history
Timeline
  • 23 JAN 03:28Z
    Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability
    cvelistv5