Is CVE-2026-91198 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-91198?

CVE-2026-91198 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-91198

Description

GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared report or experiment identifier can read internal data warehouse query text, schema, table names, filter values and datasource identifiers.