Sign in
Deutsch English Español Polski
High

Open WebUI has Broken Access Control in Tool Valves

  • Disclosed: 01.04.2026
  • Updated: 11.10.2026 14:17

Summary

Broken Access Control in Tool Valves

Open WebUI supports function calling through "Tools". Function calling allows an LLM to reliably connect to external tools and interact with external APIs. Exemplary use-cases include connecting to an internal knowledge base, retrieving emails from an exchange server, or retrieving order data from a shop backend.

These interactions often require the LLM to authenticate against backend services using API keys specifically created for a technical (Open WebUI) user.

To simplify configuration and secret handling, Open WebUI implements "Valves" and "UserValves" that allow users and administrators to input dynamic details like API keys or configuration options.

Valves have the following distinction:

  • Valves: Configurable by admins only.
  • UserValves: Configurable by any user.

The Tool Valves endpoint does not properly restrict read access to the valve. This allows a low privileged user to access all data contained within the valve. In the worst case, this gives a low privileged "Member" user access to sensitive Tool data, such as API keys for third-party systems.

Details

1) Broken Access Control in Tool Valves

The following steps can be performed to reproduce the vulnerability.

1. An administrator creates an Open WebUI Tool with a configured Valve.

<img width="1038" height="597" alt="image" src="https://github.com/user-attachments/assets/f79bdde9-18fa-49e4-a6c3-5077731f0815" />

2. The administrator configures the API key within the Tool Valve.

<img width="1039" height="446" alt="image" src="https://github.com/user-attachments/assets/d88d06b9-fc21-45e5-8142-d9f874601f87" />

3. A user with at least "Member" privileges logs into Open WebUI.

The following screenshot shows the user overview of the test instance:

<img width="908" height="354" alt="image" src="https://github.com/user-attachments/assets/40025151-418d-4912-8400-1e1a6e5cd4e4" />

The following screenshot illustrates that the "lowpriv" user doesn't have access to the tool:

<img width="815" height="433" alt="image" src="https://github.com/user-attachments/assets/ec06b07f-9735-4728-9dce-d97d721051b8" />

4. The "lowpriv" user uses their Authorization token to retrieve the API key from the Tool Valve.

In order to do so, the attacker needs to know the Tool ID. However, as this ID is always the same for imported tools, and the tool IDs are concatenated from the tool name, guessing tool IDs is trivial.

<img width="754" height="208" alt="image" src="https://github.com/user-attachments/assets/61c80cac-25c8-4730-8156-90869801389f" />

As seen in the following code snippet, the vulnerability is present because the Tool Valves route does not check if the requesting user has administrative permissions (Line 515).

Source: backend/open_webui/routers/tools.py L513–L531

PoC

You can find the detailed PoC steps in the Details section.

To execute the exploit:

  1. Login as a verified user and copy the authorization token.
  2. Access the configured valve of any existing tool with the following request (please mind the placeholders):
http
GET /api/v1/tools/id/<tool_id>/valves HTTP/1.1
Host: <your_test_host>
Authorization: Bearer <authorization_token_from_step_1>

Impact

This information disclosure vulnerability allows low privileged users to access sensitive values stored in Tool Valves. Anyone using Open WebUI Tools with a configured Valve is affected. In the worst case, exploitation allows an attacker to access third-party systems within the context of the configured Open WebUI technical user.

Additional Remarks

Additional remarks regarding the CVSS Vector String:

Component Value Rationale
AC L Due to the requirement of a "Member" account
C H Sensitive data, such as API Keys for backend systems, is disclosed
S C Exploitation of this vulnerability grants access to third-party systems

AI report transparency: AI was used for refinement of this advisory text.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) open-webui < 0.8.11 0.8.11

References

CVSS score 7.7/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness (CWE)
CWE-285
Platform
Python (PyPI)
Package
open-webui
Disclosed
01.04.2026
Updated
11.10.2026 14:17

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-2709 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-7429-hxcv-268m - CC BY 4.0

Vulnerability history: open-webui

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (161) in the archive
Total entries
161
First → latest
08.2024 09.2026
Without a fix
11
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 77
  • Medium 75
  • Low 8

Disclosures per year

Severity:
  1. Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
    High · 7.5 CVE-2026-87011 >= 0.9.0, < 0.11.1 0.11.1
  2. Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
    High · 8.1 CVE-2026-87016 >= 0.6.41, < 0.11.1 0.11.1
  3. Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
    High · 8.7 CVE-2026-87995 >= 0.8.11, < 0.11.1 0.11.1
  4. Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
    High · 7.7 CVE-2026-87996 >= 0.9.6, < 0.11.1 0.11.1
  5. Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
    High · 7.1 CVE-2026-87998 >= 0.10.0, < 0.11.1 0.11.1
  6. Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
    High · 7.1 CVE-2026-87999 < 0.11.1 0.11.1
  7. Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder
    High · 8.1 CVE-2026-70494 >= 0.10.0, < 0.11.0 0.11.0
  8. Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
    High · 8.7 CVE-2026-70492 >= 0.10.0, < 0.11.0 0.11.0
  9. Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
    High · 8.2 CVE-2026-70486 >= 0.9.0, < 0.11.0 0.11.0
  10. Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
    High · 7.1 CVE-2026-70485 >= 0.9.0, < 0.11.0 0.11.0
  11. Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
    High · 8.1 CVE-2026-70482 >= 0.8.0, < 0.11.0 0.11.0
  12. Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
    High · 7.7 CVE-2026-70479 >= 0.9.6, < 0.11.0 0.11.0
  13. open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
    High · 7.7 CVE-2026-59221 >= 0.9.6, < 0.10.0 0.10.0
  14. Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)
    High · 8.0 CVE-2026-59224 < 0.10.0 0.10.0
  15. Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id
    High · 7.7 CVE-2026-59216 < 0.10.0 0.10.0
  16. Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
    High · 7.1 CVE-2026-59714 >= 0.9.5, < 0.10.0 0.10.0
  17. Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout
    High · 7.1 CVE-2026-59219 >= 0.9.0, < 0.10.0 0.10.0
  18. Open WebUI: Stored web worker XSS via Pyodide
    High · 7.3 CVE-2026-59214 < 0.10.0 0.10.0
  19. Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages
    High · 7.3 CVE-2026-26193 < 0.6.44 0.6.44
  20. Open WebUI vulnerable to Stored XSS via iFrame in citations model
    High · 7.3 CVE-2026-26192 < 0.7.0 0.7.0
  21. Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions
    High CVE-2025-46719 < 0.6.6 0.6.6
  22. Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects
    High · 7.7 CVE-2026-54018 < 0.9.6 0.9.6
  23. Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal
    High · 7.7 CVE-2026-54017 < 0.9.6 0.9.6
  24. Open WebUI: Stored XSS to Account Takeover via Model Profile Images
    High · 7.6 CVE-2026-54013 < 0.9.6 0.9.6
  25. Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
    High · 7.1 CVE-2026-54012 < 0.9.6 0.9.6
  26. Open WebUI: Stored XSS in Mermaid Markdown Preview
    High · 8.7 CVE-2026-54011 < 0.9.6 0.9.6
  27. Open WebUI: Forged chat-file link allows cross-user file read and deletion
    High · 8.3 CVE-2026-54010 < 0.9.6 0.9.6
  28. Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)
    High · 8.5 CVE-2026-54008 < 0.9.6 0.9.6
  29. Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
    High · 6.5 CVE-2026-54007 < 0.9.6 0.9.6
  30. Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts
    High · 8.1 CVE-2026-45675 < 0.9.0 0.9.0
  31. Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed
    High · 8.8 CVE-2026-45672 < 0.8.12 0.8.12
  32. Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion
    High · 8.0 CVE-2026-45671 < 0.9.0 0.9.0
  33. Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints
    High · 8.1 CVE-2026-45402 < 0.9.5 0.9.5
  34. Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
    High · 7.3 CVE-2026-56398 < 0.9.5 0.9.5
  35. Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (not addressed by CVE-2025-65958)
    High · 8.5 CVE-2026-45401 < 0.9.5 0.9.5
  36. Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`
    High · 8.5 CVE-2026-45400 < 0.9.5 0.9.5
  37. Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption
    High · 7.1 CVE-2026-45399 < 0.9.0 0.9.0
  38. Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls
    High · 7.5 CVE-2026-45398 < 0.9.5 0.9.5
  39. Open WebUI's chat completion API allows tool restrictions to be bypassed
    High · 7.1 CVE-2026-45350 < 0.8.6 0.8.6
  40. Open WebUI has Broken Access Control for Completions API
    High · 7.1 CVE-2026-45349 < 0.9.0 0.9.0
  41. Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)
    High · 7.7 CVE-2026-45338 < 0.9.0 0.9.0
  42. Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature
    High · 8.5 CVE-2026-45331 < 0.9.0 0.9.0
  43. Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image
    High · 6.1 CVE-2026-45314 < 0.9.3 0.9.3
  44. Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions
    High · 8.7 CVE-2026-45315 < 0.9.3 0.9.3
  45. Open WebUI has stored XSS via the HTML renedering view
    High · 7.7 CVE-2026-45303 < 0.6.5 0.6.5
  46. Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file
    High · 8.1 CVE-2026-45301 < 0.3.16 0.3.16
  47. Open WebUI has inconsistent authorization controls within memories API
    High · 8.3 CVE-2026-44570 < 0.6.19 0.6.19
  48. Open WebUI's Insecure Message Access Breaks Authorization
    High · 7.1 CVE-2026-44569 < 0.6.19 0.6.19
  49. Open WebUI Arbitrary File Write, Delete via Path Traversal
    High · 8.1 CVE-2026-44565 < 0.6.10 0.6.10
  50. Open WebUI has a CORS misconfiguration and session validation issue
    High · 8.3 CVE-2026-56400 < 0.3.33 0.3.33
  51. Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal
    High · 7.3 CVE-2026-44566 < 0.1.124 0.1.124
  52. Open WebUI has Improper Authorization Control
    High · 7.3 CVE-2026-44567 < 0.1.124 0.1.124
  53. Open WebUI has stored XSS in Excel file preview
    High · 7.3 CVE-2026-44549 < 0.8.0 0.8.0
  54. Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite
    High · 8.1 CVE-2026-44554 < 0.9.0 0.9.0
  55. Open WebUI's responses passthrough endpoint lacks access control authorization
    High · 7.1 CVE-2026-44556 < 0.9.0 0.9.0
  56. Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining
    High · 7.6 CVE-2026-44555 < 0.9.0 0.9.0
  57. Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning
    High · 8.7 CVE-2026-44552 < 0.9.0 0.9.0
  58. Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access
    High · 8.1 CVE-2026-44553 < 0.9.0 0.9.0
  59. Open WebUI has an LDAP Empty Password Authentication Bypass
    Critical · 9.1 CVE-2026-44551 < 0.9.0 0.9.0
  60. open-webui Vulnerable to Stored XSS via Model Description
    High · 7.3 CVE-2026-44721 < 0.9.0 0.9.0
  61. Open WebUI has Broken Access Control in Tool Valves this entry
    High · 7.7 CVE-2026-34222 < 0.8.11 0.8.11
  62. Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite
    High · 7.1 CVE-2026-28788 < 0.8.6 0.8.6
  63. Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web
    High · 8.5 CVE-2025-65958 < 0.6.37 0.6.37
  64. Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
    High · 7.3 CVE-2025-64496 < 0.6.35 0.6.35
  65. Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
    High · 8.7 CVE-2025-64495 < 0.6.35 0.6.35
  66. Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability
    High · 7.5 ghsa-5ccf-884p-4jjq <= 0.3.21 no fix
  67. Open WebUI denial of service through endpoint for converting markdown
    High · 7.5 CVE-2024-7983 < 0.5.13 0.5.13
  68. Open WebUI lacks authentication for the `api/v1/utils/pdf` endpoint
    High · 7.5 CVE-2024-8053 < 0.5.13 0.5.13
  69. Open WebUI stored cross-site scripting (XSS) vulnerability
    High · 8.4 CVE-2024-7990 <= 0.3.8 no fix
  70. Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions
    High · 8.1 CVE-2024-8060 < 0.5.17 0.5.17
  71. Open WebUI Cross-Site Request Forgery (CSRF) Vulnerability
    High · 8.0 CVE-2024-7806 < 0.3.33 0.3.33
  72. Open WebUI Vulnerable to a Session Fixation Attack
    High · 7.6 CVE-2024-7053 <= 0.3.8 no fix
  73. Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability in api/chat/file
    High · 7.5 ghsa-6wj5-5pgr-jwq8 < 0.4.7 0.4.7
  74. Open WebUI Allows Arbitrary File Reading and Deletion
    High · 8.1 CVE-2024-7043 < 0.3.16 0.3.16
  75. Open WebUI Uncontrolled Resource Consumption vulnerability
    High · 7.5 CVE-2024-7036 <= 0.3.8 no fix
  76. Open WebUI has vulnerable dependency on starlette via fastapi
    High · 7.5 ghsa-w466-2wfc-8g58 <= 0.3.32 no fix
  77. Open WebUI Uncontrolled Resource Consumption vulnerability
    High · 7.5 CVE-2024-12534 <= 0.3.32 no fix
  78. Open WebUI Uncontrolled Resource Consumption vulnerability
    High · 7.5 CVE-2024-12537 <= 0.3.32 no fix

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.