CVE-2026-45350 Overview
CVE-2026-45350 is a missing authorization vulnerability [CWE-862] in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. Versions prior to 0.8.6 fail to verify whether the caller of the chat completion API is permitted to use the tools referenced in the request. Attackers with low-privilege accounts can supply arbitrary tool_ids or tool_servers parameters to invoke any registered server tool. The platform executes those tool invocations using server-stored authentication tokens, granting the attacker server-level privilege when the tool runs.
Critical Impact
Authenticated low-privilege users can invoke restricted server tools with server-level credentials, enabling unauthorized actions and access to integrated systems.
Affected Products
- Open WebUI versions prior to 0.8.6
- Deployments exposing the chat completion API to multi-user access
- Open WebUI instances with privileged server tools configured
Discovery Timeline
- 2026-05-15 - CVE-2026-45350 published to NVD
- 2026-05-18 - Last updated in NVD database
Technical Details for CVE-2026-45350
Vulnerability Analysis
The vulnerability resides in the chat_completion API of Open WebUI. The endpoint accepts user-supplied tool_ids and tool_servers parameters within the request body. Middleware uses those parameters to construct a tools_dict, which the get_tool_by_id function then consumes to resolve and invoke the corresponding tool.
The authorization layer never validates whether the requesting user has permission to use the resolved tool. Any authenticated user can reference any tool identifier registered on the server. When the resolved tool executes, Open WebUI uses the authentication token stored server-side rather than a token tied to the caller. The tool runs with server privilege, bypassing the access controls that ordinarily gate sensitive integrations.
Root Cause
The root cause is a missing authorization check between request parsing and tool dispatch. The middleware trusts the client-supplied tool identifiers and proceeds directly to lookup and execution. There is no per-user access control list mapping users to permitted tools, and no runtime verification that the caller owns or is entitled to invoke the requested tool.
Attack Vector
Exploitation requires network access to the Open WebUI chat completion endpoint and valid authenticated credentials at any privilege level. The attacker crafts a chat completion request that includes the identifier of a privileged tool in the tool_ids field, or specifies an arbitrary entry in tool_servers. The server resolves the tool, attaches its stored authentication token, and executes the tool action on behalf of the attacker. Because tools commonly integrate with external systems, the impact extends beyond Open WebUI itself. Refer to the GitHub Security Advisory GHSA-4pcg-253r-rf9w for the maintainer-provided technical description.
Detection Methods for CVE-2026-45350
Indicators of Compromise
- Chat completion API requests containing tool_ids or tool_servers values for tools the calling user has never invoked previously.
- Unexpected outbound requests originating from Open WebUI tool integrations to external APIs or internal services.
- Audit log entries showing tool executions where the executing user lacks an explicit grant for the tool.
Detection Strategies
- Inspect Open WebUI application logs for chat_completion requests that reference tool identifiers outside the requesting user's normal scope.
- Correlate user identity with tool invocation history to flag first-time use of high-privilege tools by low-privilege accounts.
- Monitor for anomalous use of server-stored authentication tokens against integrated third-party services.
Monitoring Recommendations
- Enable verbose logging on the chat completion middleware to capture all tool_ids and tool_servers values per request.
- Forward Open WebUI logs to a centralized SIEM and alert on tool invocations that deviate from established user baselines.
- Review network egress from the Open WebUI host for unusual destinations associated with tool integrations.
How to Mitigate CVE-2026-45350
Immediate Actions Required
- Upgrade Open WebUI to version 0.8.6 or later, which adds the missing authorization checks in the chat completion API.
- Audit all registered server tools and revoke any tokens that may have been used during the exposure window.
- Review user accounts and disable or restrict accounts that should not have access to tool functionality.
Patch Information
The maintainers fixed the vulnerability in Open WebUI 0.8.6. The patch introduces permission validation between the middleware tool resolution step and the get_tool_by_id dispatch. Patch details and remediation guidance are documented in the GitHub Security Advisory GHSA-4pcg-253r-rf9w.
Workarounds
- Restrict network access to the Open WebUI chat completion API to trusted users until the upgrade is applied.
- Temporarily unregister or disable high-privilege server tools to reduce the impact of unauthorized invocation.
- Rotate authentication tokens stored on the server for any tool that integrates with sensitive systems.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
