CVE-2026-109293
Received Received - Intake

Information Disclosure in Open WebUI via Tool Export Endpoint

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of read-only shared tools, exposing embedded API keys and credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109293
EUVD
EUVD-2026-97595

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
open-webui open-webui 0.11.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109293 is an information disclosure vulnerability in Open WebUI versions 0.11.0 to 0.11.3. It allows authenticated non-admin users with tool export permission to access the full Python source code of read-only shared tools via the GET /api/v1/tools/export endpoint. This exposes sensitive data like embedded API keys and credentials.

Detection Guidance

Check Open WebUI logs for repeated GET requests to /api/v1/tools/export by non-admin users with tool export permissions. Monitor network traffic for unauthorized access to this endpoint.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive information such as API keys and credentials embedded in shared tools. Attackers with export permissions could steal these secrets, potentially compromising other systems or data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized exposure of sensitive data such as API keys and credentials. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. The disclosure of embedded secrets may violate these regulations by exposing confidential information to unauthorized users.

Mitigation Strategies

Upgrade Open WebUI to version 0.11.4 or later. Review and restrict tool export permissions to only necessary users. Rotate any exposed API keys or credentials found in tool source code.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109293. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart