DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-70491: CVE-2026-70491: Source Code Disclosure in Open WebUI Custom Tools

#security #cve #cybersecurity

CVE-2026-70491: Source Code Disclosure in Open WebUI Custom Tools

Vulnerability ID: CVE-2026-70491
CVSS Score: 6.5
Published: 2026-08-04

An information disclosure vulnerability in Open WebUI versions 0.10.2 and earlier allows authenticated non-admin users with read-only access (or any authenticated user when a tool is shared publicly) to retrieve the raw Python source code of custom workspace tools. Because these server-side tools commonly contain hardcoded API tokens, credentials, and proprietary logic, the exposure of raw tool source code severely compromises confidentiality and can facilitate wider infrastructure compromise.

TL;DR

Open WebUI versions <= 0.10.2 fail to strip sensitive tool source code during serialization due to a permissive Pydantic schema subclass and a non-functional database column defer flag, exposing credentials to unprivileged users.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-200
  • Attack Vector: Network (AV:N)
  • CVSS v3.1: 6.5
  • EPSS Score: Not Available
  • Impact: High Confidentiality Loss
  • Exploit Status: PoC Available
  • CISA KEV Status: Not Listed

Affected Systems

  • Open WebUI
  • open-webui PyPI Package
  • Open WebUI: <= 0.10.2 (Fixed in: 0.11.0)

Code Analysis

Commit: c05de13

Fix tool content leakage by manually stripping sensitive content field when write access is false and correcting response packaging.

Exploit Details

  • GitHub Security Advisory: The official security advisory notes the presence of a functional Proof of Concept demonstrating credentials harvesting from shared tools.

Mitigation Strategies

  • Upgrade the Open WebUI deployment to version 0.11.0 or later immediately.
  • Disable custom plugin execution by setting ENABLE_PLUGINS to false in environments where custom tools are unnecessary.
  • Enforce strict access control policies on custom tools, avoiding wildcards such as sharing with everyone ('*').
  • Refactor custom tool code to fetch credentials dynamically from environment variables instead of hardcoding values inside the Python script.

Remediation Steps:

  1. Determine the current running version of Open WebUI.
  2. Pull and deploy the patched image open-webui:0.11.0 or newer.
  3. Verify that standard user accounts cannot retrieve the 'content' block of tools where they do not possess write access.
  4. Audit existing tool records in the database and rotate any API keys or tokens found hardcoded in old scripts.

References

Read the full report for CVE-2026-70491 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)