PT-2026-39269 · Unknown · Open-Webui

Published 2026-05-08 · Updated 2026-05-16 · CVE-2026-44552

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.0

Description Open WebUI fails to apply the REDIS KEY PREFIX to the tool servers and terminal servers keys within the utils/tools.py file. In deployments where multiple instances share a single Redis database—such as multi-region, blue-green, or cluster topologies—these unprefixed keys collide. This allows an administrator on one instance to overwrite the configuration read by another instance, leading to cross-instance cache poisoning. Consequently, users on a victim instance may receive a poisoned tool server configuration, potentially allowing an attacker to exfiltrate chat content, user identities, and OAuth tokens, or deliver prompt injections via trusted tool outputs.

Recommendations Update to version 0.9.0.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2026-44552

GHSA-3X8W-4F7P-XXC2

Affected Products

Open-Webui

References · 6

• https://github.com/open-webui/open-webui/security/advisories/GHSA-3x8w-4f7p-xxc2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44552 · Security Note
• https://osv.dev/vulnerability/GHSA-3x8w-4f7p-xxc2 · Vendor Advisory
• https://github.com/open-webui/open-webui · Note
• https://twitter.com/CVEnew/status/2055457529757351956 · Twitter Post
• https://twitter.com/infoflowcloud/status/2055458443289309609 · Twitter Post