# CVE-2026-109293: Open WebUI tool source code disclosure via export endpoint

Source: https://junglewise.ai/threats/cve-2026-109293-open-webui-from-0-11-0-before-0-11-4-contains-an-information  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109293 · Severity: medium · CVSS 6.5 · Published 2026-10-12

Open WebUI is a web interface for AI models that allows administrators to create and share reusable tools with team members. An authenticated user with tool export permissions can retrieve the full Python source code of any tool shared with them for read-only access, exposing embedded API keys, credentials, and internal service URLs that the tools contain. This affects deployments where non-admins have been granted export permissions and tools containing secrets have been shared with read-only access.

Technologies: [Open WebUI](https://junglewise.ai/threats/technologies/open-webui-open-webui). Vendors: [Open WebUI](https://junglewise.ai/threats/vendors/open-webui).

## Quick answers

**Is CVE-2026-109293 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109293 being exploited in the wild.

**How severe is CVE-2026-109293?** Medium severity, with a CVSS score of 6.5, published 12 October 2026.

**Which products and versions are affected?** Open WebUI 0.6.37 before 0.11.4.

**Is there a fix for CVE-2026-109293?** Yes: fixed in 0.11.4. Until then: Do not grant the tool export permission (workspace.tools_export) to non-admin users, or ensure tools containing credentials are only shared with users who already hold write access to them. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109293 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-109293?** Check whether you run Open WebUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.11.4

Do not grant the tool export permission (workspace.tools_export) to non-admin users, or ensure tools containing credentials are only shared with users who already hold write access to them.

## Technical details

The vulnerability exists in the GET /api/v1/tools/export endpoint (backend/open_webui/routers/tools.py), which builds its list of tools using the default read scope rather than restricting to owned or write-accessible tools. While the tool detail view correctly hides source code from read-only recipients, the bulk export endpoint returns it anyway, allowing any authenticated user with workspace.tools_export permission to retrieve source code they should not access. This is a confidentiality issue only; attackers cannot modify tools or gain execution rights, but the exposure of embedded credentials is critical.

## Affected products

- open-webui Open WebUI 0.6.37 before 0.11.4

## Timeline

- 2026-09-27: disclosed
- 2026-10-12: advisory
- 2026-10-12: patched: Version 0.11.4 released

## References

- [https://github.com/open-webui/open-webui/security/advisories/GHSA-2h26-836q-4jh2](https://github.com/open-webui/open-webui/security/advisories/GHSA-2h26-836q-4jh2)
- [https://www.vulncheck.com/advisories/open-webui-0.11.0-before-0.11.4-tool-source-disclosure-via-tool-export-endpoint](https://www.vulncheck.com/advisories/open-webui-0.11.0-before-0.11.4-tool-source-disclosure-via-tool-export-endpoint)

## Related threats

- [Open WebUI stored cross-site scripting in Markdown renderer](https://junglewise.ai/threats/cve-2026-109300-open-webui-from-0-6-31-before-0-11-4-contains-a-stored-cross)
- [Open WebUI denial of service in recurrence rule validation](https://junglewise.ai/threats/cve-2026-109299-open-webui-from-0-9-0-before-0-11-4-contains-a-denial-of-service)
- [Open WebUI regex denial of service in file search tools](https://junglewise.ai/threats/cve-2026-109298-open-webui-0-11-0-before-0-11-4-compiles-user-chosen-grep)
- [Open WebUI automation recurrence-rule denial of service](https://junglewise.ai/threats/cve-2026-109297-open-webui-0-11-0-before-0-11-4-contains-a-denial-of-service)
- [Open WebUI missing authorization in model provider routes](https://junglewise.ai/threats/cve-2026-109296-open-webui-before-0-11-4-contains-a-missing-authorization)