CVE-2026-109293: Open WebUI: tool export leaks shared tool source code

MEDIUMPoC AVAILABLECISA: TRACK*

Published October 12, 2026

CISO Take

Open WebUI 0.11.0 through 0.11.3 lets any authenticated non-admin user with tool export permission call GET /api/v1/tools/export and download the full Python source of tools that were shared with them as read-only. Those tool files often contain hardcoded API keys and service credentials, so a low-privilege account can become a path to your downstream LLM providers, databases and internal APIs. The CVSS is medium (6.5), there is no known public exploit or Nuclei template, it is not in CISA KEV, and EPSS data is not yet available, so exploitation is unlikely to be widespread today. The attack is trivial for anyone holding a valid account, though, and the package has 186 other CVEs on record, which shows a heavy and recurring vulnerability load. Upgrade to 0.11.4 or later, then rotate every credential embedded in any tool that has been shared in your instance.

Sources:NVDGitHub AdvisoryATLASvulncheck.com

What is the risk?

Medium overall (CVSS 6.5). The attack is network-reachable, low complexity and needs no user interaction, but it needs a valid low-privilege account that also holds tool export permission. Impact is limited to confidentiality, and it is high when tools embed secrets. Exploitation likelihood is currently low: there is no public exploit, no scanner template and no KEV listing, and EPSS is not available. The package risk score is 38/100 and it has only 3 tracked downstream dependents. Real exposure depends on whether tools in your deployment hold hardcoded secrets and on how broadly the export permission is granted.

How does the attack unfold?

Initial Access

Attacker logs in with a valid non-admin account that holds tool export permission.

AML.T0012

Exploitation

Attacker sends GET /api/v1/tools/export and receives the full Python source of tools shared read-only with them.

AML.T0084.001

Credential Harvesting

Attacker extracts hardcoded API keys and credentials from the exported tool source.

AML.T0055

Impact

Attacker uses the stolen credentials against LLM providers, databases or internal APIs outside Open WebUI controls.

AML.T0098

Initial Access

Attacker logs in with a valid non-admin account that holds tool export permission.

AML.T0012

Exploitation

Attacker sends GET /api/v1/tools/export and receives the full Python source of tools shared read-only with them.

AML.T0084.001

Credential Harvesting

Attacker extracts hardcoded API keys and credentials from the exported tool source.

AML.T0055

Impact

Attacker uses the stolen credentials against LLM providers, databases or internal APIs outside Open WebUI controls.

AML.T0098

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	—	No patch
156.7K3 dependentsPushed 6d ago76% patched~20d to patchFull package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade open-webui to 0.11.4 or later. 2) Treat every secret embedded in a tool shared in an affected instance as potentially exposed and rotate it. 3) Until patched, remove the tool export permission from non-admin users and roles, and review which tools are shared read-only. 4) Move secrets out of tool source into environment variables, valves or a secrets manager. 5) Detect abuse by reviewing reverse proxy and application logs for GET /api/v1/tools/export requests from non-admin accounts, and monitor the provider-side logs of any exposed key for unusual use. 6) Audit user accounts for the export permission and apply least privilege.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageData ExtractionPluginFrameworkAML.T0012- Valid Accounts AML.T0055- Unsecured Credentials AML.T0084.001- Tool Definitions AML.T0098- AI Agent Tool Credential Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and manage identified vulnerabilities

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-109293?

Is CVE-2026-109293 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-109293, increasing the risk of exploitation.

How to fix CVE-2026-109293?

1) Upgrade open-webui to 0.11.4 or later. 2) Treat every secret embedded in a tool shared in an affected instance as potentially exposed and rotate it. 3) Until patched, remove the tool export permission from non-admin users and roles, and review which tools are shared read-only. 4) Move secrets out of tool source into environment variables, valves or a secrets manager. 5) Detect abuse by reviewing reverse proxy and application logs for GET /api/v1/tools/export requests from non-admin accounts, and monitor the provider-side logs of any exposed key for unusual use. 6) Audit user accounts for the export permission and apply least privilege.

What systems are affected by CVE-2026-109293?

This vulnerability affects the following AI/ML architecture patterns: LLM chat interfaces, Agent tool and function frameworks, Self-hosted LLM gateways, Multi-user AI workspaces.

What is the CVSS score for CVE-2026-109293?

CVE-2026-109293 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

LLM chat interfacesAgent tool and function frameworksSelf-hosted LLM gatewaysMulti-user AI workspaces

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0055Unsecured Credentials

AML.T0084.001Tool Definitions

AML.T0098AI Agent Tool Credential Harvesting

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of read-only shared tools, exposing embedded API keys and credentials.

Exploitation Scenario

An attacker holds a regular account on a company's internal Open WebUI, for example a contractor or a compromised employee login. A colleague has shared a tool read-only that calls a paid LLM API and an internal ticketing system, with the keys hardcoded in the Python source. The attacker sends an authenticated GET request to /api/v1/tools/export, receives the full source of every tool shared with them, and extracts the keys. They then use the stolen keys directly against the LLM provider and the ticketing API, bypassing Open WebUI logging and access controls, to run up costs or pull internal data.

Weaknesses (CWE)

CWE-200Exposure of Sensitive Information to an Unauthorized Actor

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.