Executive brief
Open WebUI is a user interface for interacting with large language models. A security flaw allowed users with basic access to view the full Python source code of shared workspace tools, which they should only be able to use, not read. This is a significant risk because tool source code often contains sensitive information like API keys, internal service URLs, and credentials.
Technical details
An information disclosure vulnerability exists in Open WebUI's tool management API. The root cause is an insecure response model implementation where the 'ToolUserResponse' subclass permitted extra fields, causing the full tool model (including source code) to be serialized and returned to the caller even when the schema was intended to omit it. Additionally, the listing logic failed to properly filter source code from database queries. An authenticated attacker with read access to a tool can retrieve its full source code via the GET /api/v1/tools/, /api/v1/tools/list, or /api/v1/tools/id/{id} endpoints. This vulnerability is fixed in version 0.11.0.
Affected products
- Open WebUI open-webui <= 0.10.2
Timeline
- 2026-08-02: patched: Fix released in version 0.11.0
- 2026-08-04: disclosed: Public advisory published
References
- https://api.github.com/users/bogdancherniy11-sudo
- https://github.com/bogdancherniy11-sudo
- https://api.github.com/users/bogdancherniy11-sudo/gists%7B/gist_id%7D
- https://api.github.com/users/bogdancherniy11-sudo/repos
- https://avatars.githubusercontent.com/u/229690748?v=4
- https://api.github.com/users/bogdancherniy11-sudo/events%7B/privacy%7D