PT-2026-41180 · Unknown · Open-Webui

Published 2026-03-01 · Updated 2026-05-29 · CVE-2026-45350

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.8.6

Description A flaw in the chat completion API allows users to bypass tool restrictions, potentially leading to unauthorized actions or access. In the '/api/chat/completions' endpoint, the tool ids and tool servers parameters are supplied by the user and used by the middleware to create a tools dict, which is then processed by the get tool by id() function to retrieve the tool. Because the system fails to verify if the user has the necessary permissions to use the requested tool, an attacker can invoke any server tool by providing the correct tool id or tool servers parameters. Furthermore, the tool is executed using the server's own authentication token, granting the request server-level privileges.

Recommendations Update to version 0.8.6 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-07188

CVE-2026-45350

GHSA-4PCG-253R-RF9W

Affected Products

Open-Webui

References · 10

• 🔥 https://github.com/open-webui/open-webui/security/advisories/GHSA-4pcg-253r-rf9w · Exploit
• https://bdu.fstec.ru/vul/2026-07188 · Security Note
• https://osv.dev/vulnerability/GHSA-4pcg-253r-rf9w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45350 · Security Note
• https://github.com/open-webui/open-webui · Note
• https://github.com/open-webui/open-webui/commit/4737e1f11 · Note
• https://github.com/open-webui/open-webui/releases/tag/v0.8.6 · Note
• https://twitter.com/DFIR_Lab/status/2060150467112366228 · Twitter Post
• https://twitter.com/CVEnew/status/2055457496664248707 · Twitter Post
• https://t.me/CVEtracker/53985 · Telegram Post