https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 15:16:33 +0000 https://cve.radiocsirt.org/vuln/cve-2026-70491 <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/{id} endpoints in backend/open_webui/routers/tools.py returned full Python tool source to authenticated non-admin read-only users. ToolResponse deliberately omitted source and specs, but ToolUserResponse permitted extra fields and handlers spread a full tool model dump into the response, re-admitting omitted fields. A non-admin with a read grant can obtain another user&#39;s server-side tool source, which commonly embeds hard-coded API keys, credentials, and internal service URLs. This issue is fixed in 0.11.0.</p> <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/{id} endpoints in backend/open_webui/routers/tools.py returned full Python tool source to authenticated non-admin read-only users. ToolResponse deliberately omitted source and specs, but ToolUserResponse permitted extra fields and handlers spread a full tool model dump into the response, re-admitting omitted fields. A non-admin with a read grant can obtain another user&#39;s server-side tool source, which commonly embeds hard-coded API keys, credentials, and internal service URLs. This issue is fixed in 0.11.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-70491 https://cve.radiocsirt.org/vuln/ghsa-3r7g-q6cg-q2vx <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the list response schema deliberately omits it and source export sits behind its own permission. The read endpoints delivered it anyway.</p> <p>## Preconditions</p> <p>- Authentication enabled (`WEBUI_AUTH=true`, default) and plugins enabled (`ENABLE_PLUGINS=true`, default). - The attacker is an authenticated non-admin without the `workspace.tools` permission and without a write grant on the tool. - A tool is shared with a read grant to the attacker, to one of their groups, or to all users (`user:*`).</p> <p>Deployments that share no tools, or share them only with users who already hold write access, are not affected.</p> <p>## Impact</p> <p>A non-admin obtains another user&#39;s server-side tool source. Tool source commonly embeds hard-coded API keys, credentials and internal service URLs, so the practical loss frequently extends past the code itself. The attack needs no special permission beyond an ordinary account that a tool was shared with, and no user interaction. Confidentiality only: it grants no ability to create, modify or execute tools, and no integrity or availability impact.</p> <p>## Fix</p> <p>Fixed in 0.11.0 by commit `c05de13b4` (#27005) together with `310ae9130`. The per-id endpoint now drops the source for ca…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the list response schema deliberately omits it and source export sits behind its own permission. The read endpoints delivered it anyway.</p> <p>## Preconditions</p> <p>- Authentication enabled (`WEBUI_AUTH=true`, default) and plugins enabled (`ENABLE_PLUGINS=true`, default). - The attacker is an authenticated non-admin without the `workspace.tools` permission and without a write grant on the tool. - A tool is shared with a read grant to the attacker, to one of their groups, or to all users (`user:*`).</p> <p>Deployments that share no tools, or share them only with users who already hold write access, are not affected.</p> <p>## Impact</p> <p>A non-admin obtains another user&#39;s server-side tool source. Tool source commonly embeds hard-coded API keys, credentials and internal service URLs, so the practical loss frequently extends past the code itself. The attack needs no special permission beyond an ordinary account that a tool was shared with, and no user interaction. Confidentiality only: it grants no ability to create, modify or execute tools, and no integrity or availability impact.</p> <p>## Fix</p> <p>Fixed in 0.11.0 by commit `c05de13b4` (#27005) together with `310ae9130`. The per-id endpoint now drops the source for ca…</p> https://cve.radiocsirt.org/vuln/ghsa-3r7g-q6cg-q2vx