CVE-2026-34091 User localization leaked by AbuseFilter + EventStream
Attackers can leak user localization data via AbuseFilter and EventStream in MediaWiki, exposing sensitive information to unauthorized actors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34091?
CVE-2026-34091 is a medium-severity vulnerability in Mediawiki Mediawiki, published on 11 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
Weakness: CWE-200
Which versions are affected by CVE-2026-34091?
It affects 1 product.
Products include Mediawiki Mediawiki.
How do I fix CVE-2026-34091?
Upgrade to a fixed version.
Is CVE-2026-34091 being exploited?
There is no known exploitation of CVE-2026-34091 in the wild and no public exploit code.
Other vulnerabilities in Mediawiki Mediawiki
Sources
Also known as DEBIAN-CVE-2026-34091, GHSA-7gvw-7r69-cgx7, UBUNTU-CVE-2026-34091.