CVE-2025-29296

creationtimestamp| type| source ---|---|--- 2026-08-04 21:12:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbwhogkt22l...

Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Summary A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the...

GHSA-3R7G-Q6CG-Q2VX Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Summary A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the...

Information Exposure

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Information Exposure via the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints. An attacker can access sensitive source code and potentially embedded secrets by making...

EUVD-2026-52922

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...

CVE-2026-70491

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...

CVE-2026-70491 Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...

CVE-2026-70491 Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...

CVE-2026-70491

Open WebUI vulnerability CVE-2026-70491 affects the self-hosted Open WebUI platform. In versions up to 0.10.2, the GET endpoints /api/v1/tools/, /api/v1/tools/list, and /api/v1/tools/id/{id} exposed full Python tool source to authenticated non-admin read-only users due to the interaction between ...

CVE-2026-70491 Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...

GHSA-8X5V-CPV7-8JJP

creationtimestamp| type| source ---|---|--- 2026-08-04 20:31:40+00:00| seen| https://gist.github.com/alon710/a07f9786cabb1f06c1eba431ddd448e4...

CVE-2026-70485

creationtimestamp| type| source ---|---|--- 2026-08-04 20:31:40+00:00| seen| https://gist.github.com/alon710/a07f9786cabb1f06c1eba431ddd448e4 2026-08-04 20:35:03+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-8x5v-cpv7-8jjp...

CVE-2026-67592

creationtimestamp| type| source ---|---|--- 2026-08-04 20:12:38+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/7p5nbufssz34w...

CVE-2026-70552

creationtimestamp| type| source ---|---|--- 2026-08-04 20:12:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbt4erihi2b...

CVE-2026-67591

creationtimestamp| type| source ---|---|--- 2026-08-04 20:06:41+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/ayo27b4c6lfg2...

CVE-2026-67589

creationtimestamp| type| source ---|---|--- 2026-08-04 19:54:42+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/bdbdsyvhmjiuu 2026-08-05 06:44:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/djrrztfflnyta...

CVE-2026-67551

creationtimestamp| type| source ---|---|--- 2026-08-04 19:48:40+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/6xhmka3yohgj5 2026-08-05 06:24:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5imjmiyodl5vq...

CVE-2026-67465

creationtimestamp| type| source ---|---|--- 2026-08-04 19:42:41+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/2knjhf4ygmvex...

CVE-2026-68080

creationtimestamp| type| source ---|---|--- 2026-08-04 19:36:40+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/ipitlklyvgkln...

CVE-2026-70474

creationtimestamp| type| source ---|---|--- 2026-08-04 19:31:47+00:00| seen| https://gist.github.com/alon710/1b2f0c6a49d8d6453f101ab57c6809f5 2026-08-04 20:35:23+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wch5-xp77-fxg4 2026-08-06...