CVE-2026-70491: Open WebUI Information Disclosure Flaw

CVE-2026-70491 Overview

CVE-2026-70491 is an information disclosure vulnerability in Open WebUI, a self-hosted AI platform. Versions 0.10.2 and earlier expose full Python tool source code to authenticated non-admin users holding read-only grants. The GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/{id} endpoints in backend/open_webui/routers/tools.py return tool source that commonly embeds hard-coded API keys, credentials, and internal service URLs. The flaw is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. It is fixed in version 0.11.0.

Critical Impact
A non-admin user with a read grant can extract another user's server-side tool source, including embedded secrets such as API keys and internal endpoints.

Affected Products

Open WebUI 0.10.2 and earlier
Open WebUI self-hosted AI platform deployments exposing the tools API
Multi-tenant Open WebUI instances that issue read-only tool grants to non-admin users

Discovery Timeline

2026-08-04 - CVE-2026-70491 published to NVD
2026-08-05 - Last updated in NVD database
v0.11.0 - Open WebUI releases fixed version via GitHub Release v0.11.0

Technical Details for CVE-2026-70491

Vulnerability Analysis

The vulnerability resides in the tool-listing and tool-detail routes in backend/open_webui/routers/tools.py. The API defined two response models: ToolResponse, which deliberately omits content and specs, and ToolUserResponse, which permits extra fields via Pydantic's extra='allow' configuration. Route handlers spread a full tools.model_dump() payload into the response object. This behavior re-admits the fields that ToolResponse intended to exclude. As a result, the serializer returns the complete tool record, including the Python source stored in content, to any authenticated caller who possesses a read grant.

The exposed source frequently contains hard-coded API keys for external services, static credentials, and internal service URLs used by the tool at runtime. An attacker with a low-privilege account can enumerate accessible tool IDs and harvest embedded secrets from other users' tools without triggering write operations.

Root Cause

The root cause is inconsistent enforcement of field allowlisting during serialization. ToolResponse restricted sensitive fields through explicit schema definition, but downstream handlers used **tools.model_dump() on a permissive response model. Pydantic's extra='allow' re-admitted the omitted attributes, defeating the schema-level filter. The authorization check gated only write access; read access implicitly granted full model exposure.

Attack Vector

Exploitation requires network access to the Open WebUI API and low-privilege authenticated credentials with a tool read grant. No user interaction is needed. The attacker calls GET /api/v1/tools/id/{id} for a target tool ID and receives the full Python source in the JSON response.

python

                db=db,
            )
        ):
-            return ToolAccessResponse(
-                **tools.model_dump(),
-                write_access=(
-                    (user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL)
-                    or user.id == tools.user_id
-                    or await AccessGrants.has_access(
-                        user_id=user.id,
-                        resource_type='tool',
-                        resource_id=tools.id,
-                        permission='write',
-                        db=db,
-                    )
-                ),
+            write_access = (
+                (user.role == 'admin' and BYPASS_ADMIN_ACCESS_CONTROL)
+                or user.id == tools.user_id
+                or await AccessGrants.has_access(
+                    user_id=user.id,
+                    resource_type='tool',
+                    resource_id=tools.id,
+                    permission='write',
+                    db=db,
+                )
            )
+            data = tools.model_dump()
+            if not write_access:
+                # extra='allow' re-admits content from model_dump; source is writer-only

Source: GitHub Commit c05de13b. The patch decouples the write-access check from the response construction and strips writer-only fields, including tool source, before returning the payload to read-only callers.

Detection Methods for CVE-2026-70491

Indicators of Compromise

Access log entries showing non-admin users issuing GET /api/v1/tools/id/{id} requests against tools owned by other users
Elevated request volume against GET /api/v1/tools/ and GET /api/v1/tools/list from a single low-privilege account
JSON responses to non-admin users that include a populated content field for tools they do not own

Detection Strategies

Inspect Open WebUI application logs for read-grant users accessing tools created by other user IDs
Correlate API response sizes on /api/v1/tools/ endpoints; oversized payloads suggest source-code inclusion
Audit AccessGrants records to identify accounts holding read grants on tools that contain secrets

Monitoring Recommendations

Enable HTTP access logging on the Open WebUI reverse proxy and capture full request paths for the tools API
Alert on any account accessing more than a threshold number of distinct tool IDs within a short window
Rotate and monitor use of API keys previously stored in tool source, watching for anomalous downstream usage

How to Mitigate CVE-2026-70491

Immediate Actions Required

Upgrade Open WebUI to version 0.11.0 or later, which contains the fix from Pull Request #27005
Revoke read grants on tools that embed sensitive credentials until the upgrade is verified
Rotate any API keys, tokens, or credentials that were hard-coded in tool source on affected instances

Patch Information

The fix is included in Open WebUI v0.11.0. See the GitHub Security Advisory GHSA-3r7g-q6cg-q2vx and the corresponding commit c05de13b. The patch computes write_access first and omits source fields when the caller lacks write permission.

Workarounds

Restrict tool sharing to admin users until v0.11.0 is deployed
Remove hard-coded secrets from tool source and move them to server-side environment variables or a secrets manager
Place the Open WebUI API behind a reverse proxy that blocks /api/v1/tools/id/* for non-admin identities

bash

# Upgrade Open WebUI to the patched release
docker pull ghcr.io/open-webui/open-webui:0.11.0
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.11.0