CVE-2026-109293

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-109293

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109293.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-109293

Aliases

GHSA-2h26-836q-4jh2

Published

2026-10-12T16:04:53Z

Modified

2026-10-13T02:46:34Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint

Details

Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of read-only shared tools, exposing embedded API keys and credentials.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-200"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109293.json"
}

References

Affected packages

Git / github.com/open-webui/open-webui

Affected ranges

Type

GIT

Repo

https://github.com/open-webui/open-webui

Events

Introduced

f9590b8017199e56d5e953657e6498e3cef1d246

Fixed

8bd8b4fac5e059578ac0c74b3c18d11139f88b7d

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0.11.0"
        },
        {
            "fixed":  "0.11.4"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v0.*

v0.11.0

v0.11.1

v0.11.2

v0.11.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109293.json"