Log in Start free

Vulnerability · Published Aug 4, 2026 · Assigned by GitHub_M

CVE-2026-70491Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Medium 6.5

In plain English

A medium-severity information exposure in open-webui from open-webui. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.5%top 58.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/{id} endpoints in backend/open_webui/routers/tools.py returned full Python tool source to authenticated non-admin read-only users. ToolResponse deliberately omitted source and specs, but ToolUserResponse permitted extra fields and handlers spread a full tool model dump into the response, re-admitting omitted fields. A non-admin with a read grant can obtain another user's server-side tool source, which commonly embeds hard-coded API keys, credentials, and internal service URLs. This issue is fixed in 0.11.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIopen-webui0.11.0GHSA-3r7g-q6cg-q2vx
PyPIopen-webui0.11.0PYSEC-2026-3639

Affected products (as reported)

VendorProductVersions
open-webui open-webui < 0.11.0

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References