Live › vulnerability › CVE-2026-116108
Go to dashboardOpenBB's Local API Server (api_settings.py) has an access control flaw (CWE-284) reported by VulDB. Impact is confidentiality only, and it needs user interaction. VulDB lists a proof of concept, but I could not find a public link. The vendor has not responded and there is no fix.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 02:39 UTC. All times on this page are UTC.
Teams running OpenBB up to 4.7.2 or 5.0.0 with the Local API Server started, especially if it is reachable from other machines. The sources do not say which default settings expose the server, and do not name a fixed version. Installations that never start the local API server are likely not exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| openbb | pypi | 4.7.0 - 4.7.2, 5.0.0 | – |
pip show openbb openbb-core. VulDB lists 4.7.0, 4.7.1, 4.7.2 and 5.0 as affected.openbb-api or uvicorn openbb_core.api.rest_api:app is running. Docs say openbb-api binds 127.0.0.1:6900 and uvicorn binds 127.0.0.1:8000 by default.--host 0.0.0.0 or a container deployment, which makes the server reachable from other machines.~/.openbb_platform/system_settings.json for api_settings.cors.allow_origins. The documented example uses *.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbb_platform/core/openbb_core/app/model/api_settings.py of the component Local API Server. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116108")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.