Executive brief
Open WebUI is an interface for interacting with large language models. A vulnerability exists where multiple instances of the software sharing the same database backend can overwrite each other's configuration for external tools and terminal servers. An administrator on one instance could redirect tool requests from another instance to a malicious server, leading to the theft of user chat data, identity information, and authentication tokens.
Technical details
Open WebUI uses a REDIS_KEY_PREFIX to namespace data in shared Redis environments, but the 'tool_servers' and 'terminal_servers' keys in 'backend/open_webui/utils/tools.py' lack this prefix. This root cause allows an administrator on one instance to overwrite these global keys, which are then consumed by other instances sharing the same Redis database. An attacker with administrative privileges on one instance can point tool servers to an attacker-controlled URL. When users on a victim instance invoke tools, their chat context, user identity, and OAuth tokens are sent to the attacker's server, which can then return malicious responses that are processed as trusted LLM context. This vulnerability is patched in version 0.9.0.
Affected products
- Open WebUI open-webui <= 0.8.12
Timeline
- 2026-05-05: disclosed: Initial disclosure to vendor
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-15: patched: NVD publication and patch confirmation