CVE-2026-70491

Received Received - Intake

Open WebUI Tool Source Exposure via API Endpoints

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/{id} endpoints in backend/open_webui/routers/tools.py returned full Python tool source to authenticated non-admin read-only users. ToolResponse deliberately omitted source and specs, but ToolUserResponse permitted extra fields and handlers spread a full tool model dump into the response, re-admitting omitted fields. A non-admin with a read grant can obtain another user's server-side tool source, which commonly embeds hard-coded API keys, credentials, and internal service URLs. This issue is fixed in 0.11.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-04

Generated

2026-08-05

AI Q&A

2026-08-05

EPSS Evaluated

N/A

NVD

CVE-2026-70491

Affected Vendors & Products

Vendor	Product	Version / Range
open_webui	open_webui	to 0.11.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

Open WebUI versions 0.10.2 and earlier have an information disclosure vulnerability in three endpoints (/api/v1/tools/, /api/v1/tools/list, and /api/v1/tools/id/{id}). These endpoints exposed full Python tool source code to authenticated non-admin read-only users. The issue occurred because ToolUserResponse included extra fields that inadvertently revealed sensitive data like hard-coded API keys, credentials, and internal service URLs.

Detection Guidance

To detect this vulnerability, check if your Open WebUI version is 0.10.2 or earlier. Inspect network traffic for requests to /api/v1/tools/, /api/v1/tools/list, or /api/v1/tools/id/{id} endpoints. Verify if non-admin read-only users can access full tool source code or sensitive data in responses.

Impact Analysis

If you are a non-admin read-only user in Open WebUI 0.10.2 or earlier, you could access other users' tool source code. This could lead to unauthorized access to sensitive information such as API keys, credentials, and internal service URLs embedded in those tools. Attackers could exploit this to gain further access to systems or data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized exposure of sensitive data. GDPR requires protection of personal data, and HIPAA mandates safeguarding protected health information. The exposure of credentials and internal URLs could result in data breaches, triggering regulatory penalties and legal consequences.

Mitigation Strategies

Immediately upgrade Open WebUI to version 0.11.0 or later. Review and restrict access permissions for non-admin users to prevent unauthorized access to tool sources. Audit existing tools for exposed credentials or API keys and rotate them if compromised.

Hi! I’m here to help you understand CVE-2026-70491. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70