CVE-2026-116108 openbq-org CVE debrief

Who should care

Defenders responsible for OpenBB Local API Server instances, especially those with publicly accessible API endpoints, should assess exposure and prioritize patching. Security teams should review the vulnerability and its potential impact on their organization's assets. Operators of affected systems should verify exposure and implement compensating controls if necessary. Platform administrators should ensure that API endpoints are properly authenticated and

Why it matters

CVE-2026-116108 is a medium-severity vulnerability in openbq-org OpenBB Local API Server's api_settings.py file, allowing improper access controls. Defenders should verify exposure, assess API endpoint accessibility, and prioritize patching. The vendor did not respond to disclosure, and there is limited information on affected versions and remediation.

• Verify exposure of OpenBB Local API Server instances to unauthorized access
• Assess API endpoint accessibility and authentication mechanisms
• Consider compensating controls for unauthenticated access to API endpoints
• Monitor for potential exploitation attempts and anomalous API activity

Technical summary

The openbq-org OpenBB Local API Server's api_settings.py file is vulnerable to improper access controls, allowing remote exploitation. Affected versions include 4.7.0, 4.7.1, 4.7.2, and 5.0. The vulnerability is caused by inadequate authentication mechanisms in the Local API Server. Defenders should prioritize verifying exposure of OpenBB Local API Server instances, especially those with publicly accessible API endpoints. The vendor did not respond to disclosure, and there is limited information on affected versions and remediation.

Defensive priority

Defenders should prioritize verifying exposure of OpenBB Local API Server instances, especially those with publicly accessible API endpoints.

Recommended defensive actions

• Verify exposure of OpenBB Local API Server instances
• Assess API endpoint accessibility and authentication
• Consider compensating controls for unauthenticated access
• Monitor for potential exploitation attempts
• Review vendor-supported updates or mitigations through normal change control
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability in openbq-org OpenBB. However, the vendor did not respond to the disclosure, and there is limited information on affected versions and remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.