CVE-2026-44552: Open WebUI Information Disclosure Flaw

CVE-2026-44552 Overview

CVE-2026-44552 affects Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. The vulnerability stems from missing key prefixes for the tool_servers and terminal_servers entries in utils/tools.py. When multiple Open WebUI instances share a single Redis database, the unprefixed keys collide across instances. An administrator on one instance can overwrite the tool server configuration consumed by users on another instance. This shared-resource flaw is categorized under [CWE-668] Exposure of Resource to Wrong Sphere. The issue impacts deployments using documented multi-region, blue-green, or cluster topologies. Open WebUI version 0.9.0 resolves the issue.

Critical Impact
An administrator on one Open WebUI instance can silently overwrite tool server and terminal server configurations served to users on other instances sharing the same Redis backend, enabling cross-tenant configuration injection.

Affected Products

Open WebUI versions prior to 0.9.0
Deployments sharing a Redis database across multiple Open WebUI instances
Multi-region, blue-green, and clustered Open WebUI topologies

Discovery Timeline

2026-05-15 - CVE-2026-44552 published to the National Vulnerability Database
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-44552

Vulnerability Analysis

The vulnerability resides in utils/tools.py within the Open WebUI codebase. The tool_servers and terminal_servers Redis keys are written and read without an instance-specific or tenant-specific prefix. Redis treats these identifiers as global keys in the shared keyspace. When two or more Open WebUI instances point to the same Redis backend, writes from any instance overwrite the values consumed by every other instance. The result is unintended cross-instance configuration propagation. Because tool server definitions control which external tools Open WebUI calls on behalf of users, the impact extends beyond configuration drift into runtime behavior modification.

Root Cause

The root cause is missing namespace isolation in Redis key construction. Open WebUI supports shared-Redis deployment patterns for horizontal scaling, yet specific configuration keys were not migrated to the prefixed key scheme used elsewhere. This violates the boundary between logically separate instances that intentionally share the same data store for session and cache coordination only.

Attack Vector

The attack requires an administrator account on at least one Open WebUI instance sharing the Redis backend. The administrator updates tool server or terminal server configuration through the normal UI or API. The write reaches Redis under the global key. Other instances read that same key on the next cache lookup and serve the attacker-controlled configuration to their own users. This can redirect tool invocations to attacker-chosen endpoints, alter terminal server targets, or disrupt service integrity across the cluster. The privileges required are high, but the scope changes because impact crosses an instance boundary.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-3x8w-4f7p-xxc2 for technical details.

Detection Methods for CVE-2026-44552

Indicators of Compromise

Unexpected changes to tool server or terminal server configuration observed by users on instances where no local administrator made changes
Redis MONITOR or SLOWLOG output showing SET operations against unprefixed keys named tool_servers or terminal_servers
Tool invocation logs pointing to endpoints that do not match the instance's configured tool servers
Audit log entries for tool server changes on one instance correlated with user-facing changes on another instance

Detection Strategies

Inspect the shared Redis keyspace with KEYS tool_servers and KEYS terminal_servers to confirm whether unprefixed keys exist
Compare tool server configuration served by each instance's API against the administrative configuration stored locally
Enable Redis ACL LOG to identify which client connections write to the affected keys
Correlate Open WebUI administrative audit logs across all instances sharing a Redis backend

Monitoring Recommendations

Forward Open WebUI application logs and Redis command logs to a centralized analytics platform for cross-instance correlation
Alert on any write to tool_servers or terminal_servers keys that lack an instance prefix
Track configuration drift between instances expected to operate independently
Monitor outbound network connections from Open WebUI instances to tool server endpoints not present in the local configuration store

How to Mitigate CVE-2026-44552

Immediate Actions Required

Upgrade all Open WebUI instances sharing a Redis backend to version 0.9.0 or later in a coordinated rollout
Audit current tool server and terminal server configurations on every instance and reconcile against the intended state
Restrict administrative access to Open WebUI to reduce the population of accounts capable of triggering the collision
Review Redis access controls to ensure only Open WebUI instances connect to the shared database

Patch Information

The maintainers fixed the vulnerability in Open WebUI 0.9.0 by applying a prefix to the tool_servers and terminal_servers Redis keys. Refer to the GitHub Security Advisory GHSA-3x8w-4f7p-xxc2 for the upstream fix and upgrade guidance.

Workarounds

Assign each Open WebUI instance its own dedicated Redis database number using the db parameter in the Redis connection URL
Run separate Redis instances per Open WebUI deployment until upgrade is complete
Disable shared-Redis deployment topologies temporarily and fall back to single-instance operation
Limit administrator role assignments until all instances are upgraded

bash

# Example: separate Redis logical databases per Open WebUI instance
# Instance A
export REDIS_URL="redis://redis.internal:6379/0"

# Instance B
export REDIS_URL="redis://redis.internal:6379/1"

# Verify no collision keys remain after upgrade
redis-cli -u "$REDIS_URL" KEYS 'tool_servers'
redis-cli -u "$REDIS_URL" KEYS 'terminal_servers'