CVE-2026-109293 Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint
Authenticated non-admin users can retrieve source code of read-only shared tools, potentially exposing embedded API keys and credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-109293?
CVE-2026-109293 is a high-severity vulnerability in open-webui, published on 12 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of read-only shared tools, exposing embedded API keys and credentials.
Weakness: CWE-200
Which versions are affected by CVE-2026-109293?
How do I fix CVE-2026-109293?
No fix has been published for CVE-2026-109293 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-109293 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-109293 exists.
Sources
Also known as GHSA-2h26-836q-4jh2, GHSA-7rgv-j27q-wxqf.