Attack Chain

1. An attacker with low privileges gains access to an Open WebUI instance.
2. The attacker identifies a restricted tool configured within the Open WebUI instance.
3. The attacker crafts a malicious request to the /api/chat/completions endpoint.
4. The request includes a prompt designed to utilize the restricted tool.
5. The request contains the tool_ids parameter set to the ID of the restricted tool, or the tool_servers parameter, pointing to the restricted tool’s server.
6. The get_tool_by_id function retrieves the tool without proper permission checks.
7. The server’s authentication token is used to invoke the tool.
8. The restricted tool executes with server privileges, potentially leading to unauthorized actions.

Impact

Successful exploitation of this vulnerability allows low-privilege users to bypass intended tool restrictions and execute privileged actions within the Open WebUI environment. This can lead to unauthorized data access, modification, or other malicious activities, effectively escalating the attacker’s privileges and compromising the integrity of the system.

Recommendation

• Upgrade Open WebUI to version 0.8.6 or later to remediate CVE-2026-45350.
• Deploy the provided Sigma rule Detect Open WebUI Chat Completion API Tool Restriction Bypass to identify attempts to exploit this vulnerability via HTTP requests to the /api/chat/completions endpoint.
• Monitor web server logs for suspicious requests containing tool_ids parameters associated with restricted tools to detect potential exploitation attempts.
• Review and enforce proper access controls for tools within Open WebUI to prevent unauthorized usage, in addition to patching.