CVE-2026-0767
| CVE ID | CVE-2026-0767 |
| Vendor Disposition | Rejected, not a vulnerability |
| Published | 2026-01-23 |
| Issuing CNA | Zero Day Initiative (ZDI-26-033) |
| Claimed Severity | Medium (CVSS 5.3, CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) |
Timeline
This CVE is formally disputed. The dispute is open and being pursued through the CVE Program's process; the assessment below is Open WebUI's position in the meantime.
| Date | Event |
|---|---|
| 2025-10 | ZDI submits the underlying report through Open WebUI's security channel. Open WebUI closes it as out of scope and not a vulnerability under its published security policy, but does so without giving the reporter a written explanation at the time, which was a mistake on Open WebUI's part. |
| 2026-01-23 | ZDI publishes the CVE (ZDI-26-033). |
| 2026-05-04 | Open WebUI files a formal dispute with the CVE Program and notifies ZDI directly. Neither ZDI nor the CVE Program responds. |
| 2026-06-15 | Open WebUI files another dispute with the CVE Program; the Secretariat directs it to the issuing CNA (ZDI), which owns the record. The request is subsequently closed. |
| 2026-07-02 | With the CNA non-responsive, Open WebUI escalates the dispute a third time, to the CVE Program's Root / Top-Level Root under the CVE Record Dispute Policy (v2.0.0). |
| 2026-07-06 | Under the CVE Program's record-dispute procedure, the Program forwards the dispute to the issuing CNA (ZDI) for its determination. |
As of 2026-07-06, the dispute is before the issuing CNA (ZDI) for its determination and the CVE record has not been amended. This disposition stands as Open WebUI's official assessment.
What the CVE Claims
User credentials (email and password) submitted to Open WebUI's login endpoint are transmitted in cleartext if the application is deployed over plain HTTP rather than HTTPS, allowing a network-adjacent attacker to intercept them.
Why This Is Not a Vulnerability
This describes a property of the HTTP protocol, not a defect in Open WebUI. An unencrypted HTTP request is, by definition, not encrypted. This applies to every web application ever built.
Open WebUI is a backend application that exposes an HTTP interface. Whether that interface is exposed directly, behind a TLS-terminating reverse proxy, behind a load balancer with TLS, or via a managed platform, is the operator's deployment decision. The application does not, and is not expected to, mandate transport-layer configuration. The description is functionally equivalent to stating "if the operator deploys Apache HTTPD without HTTPS, login credentials are sent in cleartext", a true statement that does not constitute a vulnerability in Apache.
Severity
This is not scored as an Open WebUI vulnerability, because the exposure is a property of the operator's transport choice rather than of the application. The reporter's own vector reflects that: AV:A (adjacent network) and AC:H (high attack complexity) describe a scenario that requires both a plain-HTTP deployment and a network-adjacent interceptor, which does not arise behind conventional TLS termination. NVD's later enrichment re-scored the record to 6.5 with AC:L, but the determining condition is unchanged: the traffic is interceptable only if the operator runs Open WebUI over plain HTTP, a deployment choice rather than an Open WebUI defect.
Applicable Security Policy Rules
- Rule 1: Expected protocol behavior is not a vulnerability. HTTP's cleartext property is the textbook example.
- Rule 6: The scenario manifests only when the operator deploys without TLS, not a property of Open WebUI's default configuration.
- Rule 7: The report mischaracterizes a deployment-layer property as an application-layer defect.
Impact to Users
No action required, provided your deployment uses TLS. If you are running Open WebUI over plain HTTP in production, configure TLS termination via a reverse proxy, standard deployment hygiene for any web application, not a response to this CVE. See our HTTPS and Reverse Proxy Configuration guide.