Open-Webui - CraftedSignal Threat Feed

Open WebUI Missing Authorization on Tool Update Endpoint Allows Privilege Escalation to Code Execution

hello@craftedsignal.io — Thu, 14 May 2026 20:37:32 +0000

Open WebUI's tool update endpoint (POST /api/v1/tools/id/{id}/update) lacks the workspace.tools permission check that is enforced on the tool creation endpoint. This flaw permits a user, explicitly denied tool management permissions, to replace a tool's server-side Python code and execute it. The vulnerability breaks the intended security policy where workspace.tools is the trust boundary for code execution. A write access grant on a single tool is sufficient to bypass workspace.tools entirely, leading to code execution by an untrusted user. This vulnerability exists in the main branch of the Open WebUI project.

Attack Chain

An administrator deploys Open WebUI with the default configuration.
The administrator enables workspace.tools permission for a trusted user, Alice.
Alice creates a tool with benign Python code.
Alice grants write access to the tool to an untrusted user, Bob, for collaboration purposes.
The administrator disables the global workspace.tools permission.
Bob updates the tool's content via the POST /api/v1/tools/id/{id}/update endpoint with malicious Python code.
Due to the missing workspace.tools check, the malicious code is executed on the server.
Bob achieves code execution and potentially gains unauthorized access to sensitive information or systems.

Impact

This vulnerability allows an untrusted user to bypass intended security restrictions and execute arbitrary code on the Open WebUI server. Successful exploitation can lead to privilege escalation, potentially granting the attacker full control over the Open WebUI instance and access to sensitive data. The impact includes potential data breaches, system compromise, and unauthorized access to connected systems. The vulnerability affects all installations where an administrator has granted write access to tools to users without workspace.tools permissions, even if the global workspace.tools permission is subsequently revoked.

Recommendation

Apply the patch provided by Open WebUI to re-introduce the workspace.tools permission check on the tool update endpoint.
Deploy the Sigma rule Detect Open WebUI Tool Update Endpoint Bypass to detect attempts to exploit this vulnerability based on request paths.
Review existing user permissions and revoke write access to tools for any untrusted users who do not have the workspace.tools permission.
Monitor web server logs for suspicious POST requests to the /api/v1/tools/id/{id}/update endpoint (category webserver) originating from unexpected IP addresses.

Open WebUI IDOR Vulnerability in Retrieval API Allows Unauthorized Access and Modification of Knowledge Bases

hello@craftedsignal.io — Thu, 14 May 2026 20:32:37 +0000

Open WebUI, a web interface for language models, is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in its Retrieval API. This flaw, identified in commit 4d058a125 (v0.8.11) on March 26, 2026, allows authenticated users to bypass knowledge base access controls. Specifically, the _validate_collection_access function fails to properly validate access to knowledge base collections, which use UUIDs as collection names. As a result, an attacker who knows the UUID of a private knowledge base can read its contents, inject malicious content, or even overwrite the entire knowledge base through the retrieval query endpoints. This vulnerability exists because the validation function only checks for "user-memory-" and "file-" prefixes, leaving knowledge base UUIDs unchecked. This vulnerability is reachable in default configurations, affecting any non-admin account.

Attack Chain

Attacker obtains an authenticated account on the Open WebUI instance.
Victim user creates a private knowledge base containing sensitive information.
Attacker discovers the UUID of the victim's knowledge base through methods such as shared workspaces, model metadata leakage via the /api/models/list endpoint, URL leakage, or RAG citation metadata in shared chats.
Attacker crafts a malicious POST request to /api/v1/retrieval/query/doc or /api/v1/retrieval/query/collection with the victim's knowledge base UUID as the collection_name, bypassing authorization checks and reading the contents of the knowledge base.
Alternatively, the attacker crafts a POST request to /api/v1/retrieval/process/text with the victim's knowledge base UUID as the collection_name to inject attacker-controlled content into the knowledge base.
Or, the attacker crafts a POST request to /api/v1/retrieval/process/web or /api/v1/retrieval/process/youtube with the victim's knowledge base UUID as the collection_name to overwrite the victim's entire knowledge base.
The injected or replaced content is then used in downstream RAG processes, potentially leading to the exposure of sensitive information or prompt injection attacks.
The attacker successfully compromises the confidentiality, integrity, and availability of the victim's knowledge base.

Impact

This vulnerability allows unauthorized access to private knowledge bases, potentially exposing sensitive information. Attackers can inject malicious content, leading to integrity breaches and potential prompt injection attacks. The ability to overwrite knowledge bases leads to availability issues and data destruction. A successful attack can compromise the confidentiality, integrity, and availability of user data, potentially affecting all users of the Open WebUI instance.

Recommendation

Deploy the following Sigma rule to detect unauthorized access to knowledge bases by monitoring API requests containing UUID-formatted collection_name parameters: Detect Open WebUI Unauthorized Knowledge Base Access.
Deploy the Sigma rule Detect Open WebUI Knowledge Base Manipulation via Retrieval API to identify malicious POST requests to /api/v1/retrieval/process/* endpoints with knowledge base UUIDs as collection_name.
Apply the remediation steps suggested in the original advisory by checking permission on the KB collection in the _validate_collection_access function.
Monitor web server logs for unusual activity related to the vulnerable endpoints (/api/v1/retrieval/query/doc, /api/v1/retrieval/query/collection, /api/v1/retrieval/process/text, /api/v1/retrieval/process/web, /api/v1/retrieval/process/youtube, /api/v1/retrieval/process/file, /api/v1/retrieval/process/files/batch).

Open WebUI CORS Misconfiguration and Session Validation Vulnerability Leads to RCE

hello@craftedsignal.io — Mon, 11 May 2026 14:05:41 +0000

A critical vulnerability exists in Open WebUI version v0.3.10 due to a combination of CORS misconfiguration (GHSL-2024-174) and session management flaws (GHSL-2024-175). The CORS misconfiguration on multiple API endpoints allows arbitrary websites to make authenticated cross-site requests to Open WebUI. When combined with the failure to invalidate session cookies upon logout, this allows an attacker to perform a one-click attack, potentially gaining remote code execution on the Open WebUI instance. The application, by default, runs as root within a Docker container, escalating the impact to a full container compromise. This vulnerability affects users who have admin access to the /api/v1/functions endpoint, allowing execution of arbitrary code.

Attack Chain

An attacker crafts a malicious website (attacker.com) containing JavaScript code that exploits the CORS misconfiguration.
The attacker lures an Open WebUI administrator to visit the malicious website.
The JavaScript on the attacker's website bypasses CORS restrictions due to the allow_origins=["*"] configuration.
The malicious script sends an authenticated POST request to the /api/v1/functions/create endpoint, creating a malicious filter. This step requires the user to have an active Open WebUI session.
The attacker's script then sends another POST request to /api/v1/functions/id/{filter_id}/toggle to activate the newly created filter, executing arbitrary code.
The code injected by the filter executes a command (e.g., whoami) and writes the output to a file (/tmp/whoami.txt) on the Open WebUI server.
Because Open WebUI reuses session cookies after logout, the attacker can potentially regain access even if the admin has logged out, provided the browser hasn't been closed.
The attacker achieves remote code execution on the Open WebUI server, with the potential to fully compromise the Docker container due to the default root user context.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the Open WebUI server. Given the default configuration where Open WebUI runs as root within a Docker container, this can lead to a complete compromise of the container and potentially the host system. The vulnerability affects any Open WebUI instance with an administrator who visits the malicious website, making it a widespread risk. The lack of session invalidation post-logout increases the window of opportunity for attackers, even if the admin user is no longer actively using the application.

Recommendation

Modify the Open WebUI CORS configuration to remove the permissive allow_origins=["*"] and implement a more restrictive policy. Allow dynamic setup of allowed origins via the administration panel or a configuration file, as described in the remediation guidance for GHSL-2024-174.
Implement proper session invalidation upon logout. Ensure new cookies are generated for every session, and invalidate/remove previous session cookies from the browser's storage upon logout, as described in the remediation guidance for GHSL-2024-175.
Deploy the Sigma rule "Detect Open WebUI Function Creation via API" to identify potential exploitation attempts targeting the /api/v1/functions/create endpoint.

Open WebUI Arbitrary File Write/Delete via Path Traversal

hello@craftedsignal.io — Mon, 11 May 2026 14:05:23 +0000

Open WebUI version 0.1.105 is vulnerable to a path traversal vulnerability (CVE-2026-44565) affecting the /ollama/models/upload API route. This vulnerability, discovered by Taylor Pennington of KoreLogic, Inc., allows an attacker to upload files with arbitrary names to the server. Due to the lack of filename sanitization, an attacker can use dot-segments (../) to traverse the filesystem and write files to locations outside the intended upload directory. After the file is written successfully, the application attempts to remove the file using os.remove(file_path), leading to arbitrary file deletion. This issue can lead to denial of service or potentially be chained with other vulnerabilities for more severe impact if the attacker can overwrite critical system files.

Attack Chain

The attacker gains access to the Open WebUI HTTP interface.
The attacker crafts a malicious HTTP POST request to the /ollama/models/upload endpoint.
The request includes a file attachment with a filename containing path traversal sequences (e.g., ../../../../../../../tmp/DELETE_ME).
The server receives the request and, without proper sanitization, constructs a file path using the attacker-controlled filename and saves the uploaded file to the specified location.
The server attempts to pass the file to another internal API.
Once the file is successfully processed by the internal API, the server attempts to remove the file using os.remove(file_path) with the attacker-controlled path.
Due to the path traversal vulnerability, the server deletes the file at the attacker-specified location on the filesystem.

Impact

Successful exploitation of this vulnerability allows an attacker to delete arbitrary files on the system that the Open WebUI user has permissions to modify. This can lead to denial of service, data loss, or potentially be chained with other vulnerabilities to achieve arbitrary code execution if the attacker is able to overwrite critical system files. While the source mentions it might be possible to create a race condition, this was not validated.

Recommendation

Apply the vendor-provided patch or upgrade to a version of Open WebUI greater than 0.1.105, which incorporates the recommended mitigation (https://github.com/advisories/GHSA-j3fw-wc48-29g3).
Deploy the Sigma rule "Detect Open WebUI Path Traversal Upload Attempt" to identify malicious requests attempting to exploit CVE-2026-44565.
Monitor web server logs for HTTP POST requests to the /ollama/models/upload endpoint containing filenames with path traversal sequences to identify potential exploitation attempts.