CVE-2026-44552: Open WebUI cross-instance cache poisoning in Redis tool servers

CVE-2026-44552 · Severity: high · CVSS 8.7 · Published 2026-05-15

Open WebUI is an interface for interacting with large language models. A vulnerability exists where multiple instances of the software sharing the same database backend can overwrite each other's configuration for external tools and terminal servers. An administrator on one instance could redirect tool requests from another instance to a malicious server, leading to the theft of user chat data, identity information, and authentication tokens.

Technologies: open-webui (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-44552 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44552 being exploited in the wild.
How severe is CVE-2026-44552?
High severity, with a CVSS score of 8.7, published 15 May 2026.
Which products and versions are affected?
open-webui (PyPI) <= 0.8.12, ECOSYSTEM:introduced=0,fixed=0.9.0.
Is there a fix for CVE-2026-44552?
Yes. open-webui (PyPI): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44552 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44552?
Check whether you run open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • open-webui (PyPI): upgrade to 0.9.0 or later
    pip install "open-webui>=0.9.0"

Technical details

Open WebUI uses a REDIS_KEY_PREFIX to namespace data in shared Redis environments, but the 'tool_servers' and 'terminal_servers' keys in 'backend/open_webui/utils/tools.py' lack this prefix. This root cause allows an administrator on one instance to overwrite these global keys, which are then consumed by other instances sharing the same Redis database. An attacker with administrative privileges on one instance can point tool servers to an attacker-controlled URL. When users on a victim instance invoke tools, their chat context, user identity, and OAuth tokens are sent to the attacker's server, which can then return malicious responses that are processed as trusted LLM context. This vulnerability is patched in version 0.9.0.

Affected products

  • Open WebUI open-webui <= 0.8.12

Identifiers

  • CVE-2026-44552
  • GHSA-3x8w-4f7p-xxc2
  • PYSEC-2026-2696

Timeline

  • 2026-05-05: disclosed: Initial disclosure to vendor
  • 2026-05-08: advisory: GitHub Advisory published
  • 2026-05-15: patched: NVD publication and patch confirmation

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.