This vulnerability in wandb OpenUI affects versions up to 1.0 and involves hard-coded credentials due to manipulation of the LITELLM_MASTER_KEY argument in the backend/openui/config.py file. The attack vector is local with low complexity and requires low privileges. The CVSS 4.8 score reflects the medium severity, considering the limited attack vector and impact. The vendor has not provided a patch or advisory, and no official fix is currently available.

The presence of hard-coded credentials can allow an attacker with local access to gain unauthorized access or escalate privileges within the affected system. However, exploitation requires local access and low privileges, limiting the scope of impact. There is no evidence of remote exploitation or widespread active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should restrict local access to trusted personnel only and monitor for any unusual local activity related to wandb OpenUI. Avoid deploying affected versions in untrusted environments until a fix is released.