CVE-2026-109293

6.5Medium

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-200

Impact

Authenticated non-admin users can steal the full Python source code of read-only shared tools, exposing embedded API keys and secrets. They only need a valid user account with tool export permissions.

Root cause

The /api/v1/tools/export endpoint improperly includes full underlying tool source code when exporting read-only shared tools.

Affected systems

Open WebUI from 0.11.0 before 0.11.4

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade Open WebUI to version 0.11.4 or higher. As an interim mitigation, revoke tool export permissions from non-admin users or avoid hardcoding secrets in shared tools.

shell

$ docker pull ghcr.io/open-webui/open-webui:0.11.4

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of read-only shared tools, exposing embedded API keys and credentials.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109293