Securaity Browse advisories
SA-26-046 High

Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance…

Open WebUI

More for Open WebUI RSS feed for Open WebUI

Severity
High, CVSS 8.7
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Record
CVE-2026-44552
Affects
Open WebUI
Known exploited
Not listed in the CISA Known Exploited Vulnerabilities catalog
Published
Record first published by the source
May 15, 2026
Source last modified
June 17, 2026

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the tool_servers and terminal_servers keys in utils/tools.py do use a prefix. When two or more Open WebUI instances share a Redis database (a supported and documented deployment pattern, e.g., for multi-region deployments, blue-green setups, or cluster topologies), the unprefixed keys collide. An admin on Instance A writing to tool_servers overwrites the value read by Instance B — causing Instance B's users to receive Instance A's tool server configuration. This vulnerability is fixed in 0.9.0.

Description quoted from the NVD record.

Who is affected

Open WebUI is a self-hosted website that lets people chat with AI models. This flaw affects versions before 0.9.0, but only when two or more copies of Open WebUI share the same Redis database (a shared data store), a setup used for things like running in several regions or as a cluster. In that setup, an administrator on one copy who changes the settings for connected tool servers (outside services that give the AI extra abilities) overwrites the settings the other copy reads. Users of the other copy then get the first copy's tool server settings. This flaw is rated High.

What to do

  1. The person who installed or runs Open WebUI for your organization should check which version is in use and whether more than one copy shares a Redis database.
  2. If your organization runs Open WebUI on a version before 0.9.0, update it to 0.9.0, which fixes this flaw.
  3. Make sure every copy that shares the Redis database is moved to 0.9.0, so none is left on an affected version.
  4. If an IT provider or vendor runs Open WebUI for you, send them this advisory and ask when the update to 0.9.0 will be done.

Analysis written from the source record as of June 17, 2026 and reviewed before publishing.

Sources

MORE ADVISORIES

See all