{"vulnerability": "cve-2026-70491", "sightings": [{"uuid": "d3d2796d-abd0-445a-9424-ef1ca020cdf4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-70491", "type": "published-proof-of-concept", "source": "https://github.com/open-webui/open-webui/security/advisories/GHSA-3r7g-q6cg-q2vx", "content": "", "creation_timestamp": "2026-08-04T22:35:12.608368Z"}, {"uuid": "6399e5d6-b8ad-4a46-b336-014f2a05199d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70491", "type": "seen", "source": "https://gist.github.com/alon710/33c3bff7f99aec7fdcddc66966d519a0", "content": "# CVE-2026-70491: CVE-2026-70491: Source Code Disclosure in Open WebUI Custom Tools\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70491\n\n## Summary\nAn information disclosure vulnerability in Open WebUI versions 0.10.2 and earlier allows authenticated non-admin users with read-only access (or any authenticated user when a tool is shared publicly) to retrieve the raw Python source code of custom workspace tools. Because these server-side tools commonly contain hardcoded API tokens, credentials, and proprietary logic, the exposure of raw tool source code severely compromises confidentiality and can facilitate wider infrastructure compromise.\n\n## TL;DR\nOpen WebUI versions <= 0.10.2 fail to strip sensitive tool source code during serialization due to a permissive Pydantic schema subclass and a non-functional database column defer flag, exposing credentials to unprivileged users.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 6.5\n- **EPSS Score**: Not Available\n- **Impact**: High Confidentiality Loss\n- **Exploit Status**: PoC Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Open WebUI\n- open-webui PyPI Package\n- **Open WebUI**: <= 0.10.2 (Fixed in: `0.11.0`)\n\n## Mitigation\n\n- Upgrade the Open WebUI deployment to version 0.11.0 or later immediately.\n- Disable custom plugin execution by setting ENABLE_PLUGINS to false in environments where custom tools are unnecessary.\n- Enforce strict access control policies on custom tools, avoiding wildcards such as sharing with everyone ('*').\n- Refactor custom tool code to fetch credentials dynamically from environment variables instead of hardcoding values inside the Python script.\n\n**Remediation Steps:**\n1. Determine the current running version of Open WebUI.\n2. Pull and deploy the patched image open-webui:0.11.0 or newer.\n3. Verify that standard user accounts cannot retrieve the 'content' block of tools where they do not possess write access.\n4. Audit existing tool records in the database and rotate any API keys or tokens found hardcoded in old scripts.\n\n## References\n\n- [GHSA-3r7g-q6cg-q2vx Security Advisory](https://github.com/open-webui/open-webui/security/advisories/GHSA-3r7g-q6cg-q2vx)\n- [Fix Tool Serialization Code Change](https://github.com/open-webui/open-webui/commit/c05de13b4fca1ac8a17153782b46b3d0aacf491c)\n- [Open WebUI v0.11.0 Release Notes](https://github.com/open-webui/open-webui/releases/tag/v0.11.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70491) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T14:31:53.370108Z"}]}