Open WebUI: Open WebUI's chat completion API allows tool restrictions to be bypassed
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 7.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
- Record
- CVE-2026-45350
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 15, 2026
- Source last modified
- June 17, 2026
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.6, there is a vulnerability in chat completion API, which allows attackers to bypass tool restrictions, potentially enabling unauthorized actions or access. In the chat_completion API, the parameters tool_ids and tool_servers are supplied by the user. These parameters are used to create a tools_dict by the middleware. This is then used by get_tool_by_id to retrieve the appropriate tool. However, there is no checks in that ensures the user that uses the API has permission to use the tool, meaning that a user can invoke any server tool by supplying the correct tool_id or tool_servers parameters via the chat completion API. Moreover, the authentication token stored in the server would be used when invoking the tool, so the tool will be invoked with the server privilege. This vulnerability is fixed in 0.8.6.
Description quoted from the NVD record.
Who is affected
Open WebUI is a chat interface for AI language models that your organization runs on its own computers, designed to work entirely offline. This flaw affects versions before 0.8.6. It sits in the part of the product that lets programs send chat requests to it. A user of Open WebUI can use that part to run any tool set up on the server, even tools they have not been given permission to use. The tool then runs with the server's own stored login, which could let the user take actions or reach information they should not. This flaw is rated High.
What to do
- If someone in your organization installed and runs Open WebUI, that person should act on this flaw. If an IT provider or vendor runs it for you, they are the ones to act.
- Find out which version of Open WebUI you run. Any version before
0.8.6has this flaw. - Update Open WebUI to version
0.8.6or later, which fixes this flaw. - If an IT provider or vendor manages Open WebUI for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of June 17, 2026 and reviewed before publishing.