Sign in
Deutsch English Español Polski
Medium

Open WebUI Exposes System Prompt to Regular User [Non-Admin]

  • Disclosed: 14.05.2026
  • Updated: 11.10.2026 14:18

Summary

A regular user [non-admin] can view the system prompt of the model which is set by an admin.

Details

When a regular user [non-admin] logs into the application, a http://IP:8080/api/models? web request is initiated by the application and in response, it reveals the system prompt of available models set by admin on models pages in workspace affecting the confidentiality of application

Affected System

Open WebUI v0.6.40 "main" branch

Vulnerability Details and Advisory from OWASP

LLM07:2025 System Prompt Leakage - https://genai.owasp.org/llmrisk/llm072025-system-prompt-leakage/

PoC

1. Regular User [Non-Admin] login on Open WebUI application. 2. A series of web requests get generated by the application, and the http://IP:8080/api/models? is also gets generated by application . 3. The response of http://IP:8080/api/models? web request reveals the system prompt of all the available models which is set is by the admin on models pages in workspace. <img width="940" height="352" alt="system prompt leak" src="https://github.com/user-attachments/assets/bd2c76f1-398f-4bc8-a8b2-5e14a768c560" />

Web Request

GET /api/models? HTTP/1.1 Host: localhost:8080 sec-ch-ua-platform: "Linux" authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjdmYjUxMmFhLTBmMTAtNDRkZi1iOWY1LThmNDg2MWFhNWFmOCIsImV4cCI6MTc2NjU2MjE5OH0.yJpavBynKItPQv76SMGKK012JIf29PVUv9sjuCDuRGQ Accept-Language: en-US,en;q=0.9 sec-ch-ua: "Chromium";v="141", "Not?A_Brand";v="8" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Accept: application/json Content-Type: application/json Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: http://localhost:8080/ Accept-Encoding: gzip, deflate, br Cookie: token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjdmYjUxMmFhLTBmMTAtNDRkZi1iOWY1LThmNDg2MWFhNWFmOCIsImV4cCI6MTc2NjU2MjE5OH0.yJpavBynKItPQv76SMGKK012JIf29PVUv9sjuCDuRGQ Connection: keep-alive

Impact

1. System prompts can reveal the model instructions, providing an attackers with inside knowledge about the system capabilities and bypass restrictions. 2. Attacker can perform content manipulation affecting the input/output of the model.

Details from MITRE ATLAS

Discover LLM System Information - https://atlas.mitre.org/techniques/AML.T0069 Discover LLM System Information: System Instruction Keywords - https://atlas.mitre.org/techniques/AML.T0069.001 Discover LLM System Information: System Prompt - https://atlas.mitre.org/techniques/AML.T0069.002

Recommendation

1. The web response should not reveal system prompt and related internal/back-end details regarding the model to the regular user. 2. Only the model name and non-sensitive details should be revealed to regular user and internal/back-end details should not be disclosed.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) open-webui < 0.8.9 0.8.9

References

CVSS score 6.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE)
CWE-200
Platform
Python (PyPI)
Package
open-webui
Disclosed
14.05.2026
Updated
11.10.2026 14:18

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-2741 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-jh9g-8jqw-m2qx - CC BY 4.0

Vulnerability history: open-webui

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (161) in the archive
Total entries
161
First → latest
08.2024 09.2026
Without a fix
11
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 77
  • Medium 75
  • Low 8

Disclosures per year

Severity:
  1. Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
    High · 7.5 CVE-2026-87011 >= 0.9.0, < 0.11.1 0.11.1
  2. Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
    High · 8.1 CVE-2026-87016 >= 0.6.41, < 0.11.1 0.11.1
  3. Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
    High · 8.7 CVE-2026-87995 >= 0.8.11, < 0.11.1 0.11.1
  4. Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
    High · 7.7 CVE-2026-87996 >= 0.9.6, < 0.11.1 0.11.1
  5. Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
    High · 7.1 CVE-2026-87998 >= 0.10.0, < 0.11.1 0.11.1
  6. Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
    High · 7.1 CVE-2026-87999 < 0.11.1 0.11.1
  7. Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder
    High · 8.1 CVE-2026-70494 >= 0.10.0, < 0.11.0 0.11.0
  8. Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
    High · 8.7 CVE-2026-70492 >= 0.10.0, < 0.11.0 0.11.0
  9. Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
    High · 8.2 CVE-2026-70486 >= 0.9.0, < 0.11.0 0.11.0
  10. Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
    High · 7.1 CVE-2026-70485 >= 0.9.0, < 0.11.0 0.11.0
  11. Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
    High · 8.1 CVE-2026-70482 >= 0.8.0, < 0.11.0 0.11.0
  12. Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
    High · 7.7 CVE-2026-70479 >= 0.9.6, < 0.11.0 0.11.0
  13. open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
    High · 7.7 CVE-2026-59221 >= 0.9.6, < 0.10.0 0.10.0
  14. Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)
    High · 8.0 CVE-2026-59224 < 0.10.0 0.10.0
  15. Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id
    High · 7.7 CVE-2026-59216 < 0.10.0 0.10.0
  16. Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
    High · 7.1 CVE-2026-59714 >= 0.9.5, < 0.10.0 0.10.0
  17. Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout
    High · 7.1 CVE-2026-59219 >= 0.9.0, < 0.10.0 0.10.0
  18. Open WebUI: Stored web worker XSS via Pyodide
    High · 7.3 CVE-2026-59214 < 0.10.0 0.10.0
  19. Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages
    High · 7.3 CVE-2026-26193 < 0.6.44 0.6.44
  20. Open WebUI vulnerable to Stored XSS via iFrame in citations model
    High · 7.3 CVE-2026-26192 < 0.7.0 0.7.0
  21. Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions
    High CVE-2025-46719 < 0.6.6 0.6.6
  22. Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects
    High · 7.7 CVE-2026-54018 < 0.9.6 0.9.6
  23. Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal
    High · 7.7 CVE-2026-54017 < 0.9.6 0.9.6
  24. Open WebUI: Stored XSS to Account Takeover via Model Profile Images
    High · 7.6 CVE-2026-54013 < 0.9.6 0.9.6
  25. Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
    High · 7.1 CVE-2026-54012 < 0.9.6 0.9.6
  26. Open WebUI: Stored XSS in Mermaid Markdown Preview
    High · 8.7 CVE-2026-54011 < 0.9.6 0.9.6
  27. Open WebUI: Forged chat-file link allows cross-user file read and deletion
    High · 8.3 CVE-2026-54010 < 0.9.6 0.9.6
  28. Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)
    High · 8.5 CVE-2026-54008 < 0.9.6 0.9.6
  29. Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
    High · 6.5 CVE-2026-54007 < 0.9.6 0.9.6
  30. Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts
    High · 8.1 CVE-2026-45675 < 0.9.0 0.9.0
  31. Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed
    High · 8.8 CVE-2026-45672 < 0.8.12 0.8.12
  32. Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion
    High · 8.0 CVE-2026-45671 < 0.9.0 0.9.0
  33. Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints
    High · 8.1 CVE-2026-45402 < 0.9.5 0.9.5
  34. Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
    High · 7.3 CVE-2026-56398 < 0.9.5 0.9.5
  35. Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (not addressed by CVE-2025-65958)
    High · 8.5 CVE-2026-45401 < 0.9.5 0.9.5
  36. Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`
    High · 8.5 CVE-2026-45400 < 0.9.5 0.9.5
  37. Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption
    High · 7.1 CVE-2026-45399 < 0.9.0 0.9.0
  38. Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls
    High · 7.5 CVE-2026-45398 < 0.9.5 0.9.5
  39. Open WebUI Exposes System Prompt to Regular User [Non-Admin] this entry
    Medium · 6.5 CVE-2026-45351 < 0.8.9 0.8.9
  40. Open WebUI's chat completion API allows tool restrictions to be bypassed
    High · 7.1 CVE-2026-45350 < 0.8.6 0.8.6
Show more (20) Showing 40 of 79

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.