116565 matches found
Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints
Summary A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the...
CVE-2026-70491
Open WebUI vulnerability CVE-2026-70491 affects the self-hosted Open WebUI platform. In versions up to 0.10.2, the GET endpoints /api/v1/tools/, /api/v1/tools/list, and /api/v1/tools/id/{id} exposed full Python tool source to authenticated non-admin read-only users due to the interaction between ...
CVE-2026-70491 Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...
GHSA-8X5V-CPV7-8JJP
creationtimestamp| type| source ---|---|--- 2026-08-04 20:31:40+00:00| seen| https://gist.github.com/alon710/a07f9786cabb1f06c1eba431ddd448e4...
CVE-2026-70485
creationtimestamp| type| source ---|---|--- 2026-08-04 20:31:40+00:00| seen| https://gist.github.com/alon710/a07f9786cabb1f06c1eba431ddd448e4 2026-08-04 20:35:03+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-8x5v-cpv7-8jjp...
CVE-2026-67592
creationtimestamp| type| source ---|---|--- 2026-08-04 20:12:38+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/7p5nbufssz34w...
CVE-2026-70552
creationtimestamp| type| source ---|---|--- 2026-08-04 20:12:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbt4erihi2b...
CVE-2026-67591
creationtimestamp| type| source ---|---|--- 2026-08-04 20:06:41+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/ayo27b4c6lfg2...
CVE-2026-67589
creationtimestamp| type| source ---|---|--- 2026-08-04 19:54:42+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/bdbdsyvhmjiuu 2026-08-05 06:44:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/djrrztfflnyta...
CVE-2026-67551
creationtimestamp| type| source ---|---|--- 2026-08-04 19:48:40+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/6xhmka3yohgj5 2026-08-05 06:24:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5imjmiyodl5vq...
CVE-2026-67465
creationtimestamp| type| source ---|---|--- 2026-08-04 19:42:41+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/2knjhf4ygmvex...
CVE-2026-68080
creationtimestamp| type| source ---|---|--- 2026-08-04 19:36:40+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/ipitlklyvgkln...
GHSA-WCH5-XP77-FXG4
creationtimestamp| type| source ---|---|--- 2026-08-04 19:31:47+00:00| seen| https://gist.github.com/alon710/1b2f0c6a49d8d6453f101ab57c6809f5...
CVE-2026-70474
creationtimestamp| type| source ---|---|--- 2026-08-04 19:31:47+00:00| seen| https://gist.github.com/alon710/1b2f0c6a49d8d6453f101ab57c6809f5 2026-08-04 20:35:23+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wch5-xp77-fxg4 2026-08-06...
CVE-2026-68077
creationtimestamp| type| source ---|---|--- 2026-08-04 19:24:41+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/dmnlv6p3la6cs...
CVE-2026-49435
creationtimestamp| type| source ---|---|--- 2026-08-04 19:18:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbq3sut7l22 2026-08-04 20:00:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msbsho4k232t...
CVE-2026-16618
creationtimestamp| type| source ---|---|--- 2026-08-04 19:12:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbpr42iup2l...
CVE-2026-47616
creationtimestamp| type| source ---|---|--- 2026-08-04 18:49:15+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3msboiblw2p2l...