# CVE-2026-44552: Open WebUI cross-instance cache poisoning in Redis tool servers

Source: https://junglewise.ai/threats/cve-2026-44552-open-webui-cross-instance-cache-poisoning-in-redis-tool-servers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-15. Updated: 2026-05-16  
License: CC BY 4.0 with a link back

CVE-2026-44552 · Severity: high · CVSS 8.7 · Published 2026-05-15

Open WebUI is an interface for interacting with large language models. A vulnerability exists where multiple instances of the software sharing the same database backend can overwrite each other's configuration for external tools and terminal servers. An administrator on one instance could redirect tool requests from another instance to a malicious server, leading to the theft of user chat data, identity information, and authentication tokens.

Technologies: [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-44552 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44552 being exploited in the wild.

**How severe is CVE-2026-44552?** High severity, with a CVSS score of 8.7, published 15 May 2026.

**Which products and versions are affected?** open-webui (PyPI) <= 0.8.12, ECOSYSTEM:introduced=0,fixed=0.9.0.

**Is there a fix for CVE-2026-44552?** Yes. open-webui (PyPI): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44552 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44552?** Check whether you run open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- open-webui (PyPI): upgrade to 0.9.0 or later

  ```sh
  pip install "open-webui>=0.9.0"
  ```


## Technical details

Open WebUI uses a REDIS_KEY_PREFIX to namespace data in shared Redis environments, but the 'tool_servers' and 'terminal_servers' keys in 'backend/open_webui/utils/tools.py' lack this prefix. This root cause allows an administrator on one instance to overwrite these global keys, which are then consumed by other instances sharing the same Redis database. An attacker with administrative privileges on one instance can point tool servers to an attacker-controlled URL. When users on a victim instance invoke tools, their chat context, user identity, and OAuth tokens are sent to the attacker's server, which can then return malicious responses that are processed as trusted LLM context. This vulnerability is patched in version 0.9.0.

## Affected products

- Open WebUI open-webui <= 0.8.12

## Identifiers

- CVE-2026-44552
- GHSA-3x8w-4f7p-xxc2
- PYSEC-2026-2696

## Timeline

- 2026-05-05: disclosed: Initial disclosure to vendor
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-15: patched: NVD publication and patch confirmation

## References

- [https://api.github.com/users/Classic298](https://api.github.com/users/Classic298)
- [https://github.com/Classic298](https://github.com/Classic298)
- [https://api.github.com/users/Classic298/gists%7B/gist_id%7D](https://api.github.com/users/Classic298/gists%7B/gist_id%7D)
- [https://api.github.com/users/Classic298/repos](https://api.github.com/users/Classic298/repos)
- [https://avatars.githubusercontent.com/u/27028174?v=4](https://avatars.githubusercontent.com/u/27028174?v=4)
- [https://api.github.com/users/Classic298/events%7B/privacy%7D](https://api.github.com/users/Classic298/events%7B/privacy%7D)

## Related threats

- [Open WebUI OAuth token exchange authorization bypass](https://junglewise.ai/threats/cve-2026-88006-open-webui-oauth-token-exchange-authorization-bypass)
- [Open WebUI OAuth token exchange authorization bypass](https://junglewise.ai/threats/cve-2026-88005-open-webui-oauth-token-exchange-authorization-bypass)
- [Open WebUI infinite loop denial of service in chat history reconstruction](https://junglewise.ai/threats/cve-2026-88002-open-webui-infinite-loop-denial-of-service-in-chat-history)
- [Open WebUI server-side request forgery via unvalidated HTTP redirects](https://junglewise.ai/threats/cve-2026-88001-open-webui-server-side-request-forgery-via-unvalidated-http)
- [Open WebUI denial of service via cyclic chat tree message deletion](https://junglewise.ai/threats/cve-2026-88000-open-webui-denial-of-service-via-cyclic-chat-tree-message)