CVE-2026-59222: Open WebUI channel IDOR leaks

Q: Is CVE-2026-59222 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-59222, increasing the risk of exploitation.

Q: How to fix CVE-2026-59222?

Upgrade Open WebUI to version 0.10.0 or later, which fixes the endpoint to stop returning full UserModelResponse objects for channel members. Until upgraded, restrict who can join or be added to channels, and treat any existing toolServer API keys or webhook secrets configured by users in shared channels as potentially exposed — rotate them proactively. Review reverse-proxy/application logs for repeated calls to GET /api/v1/channels/{id}/members from non-admin accounts as a detection signal, and audit which external tool servers/webhooks are reachable with the affected credentials to scope any downstream exposure.

Q: What systems are affected by CVE-2026-59222?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, self-hosted LLM chat/gateway platforms, multi-user collaboration layers.

Q: What is the CVSS score for CVE-2026-59222?

No CVSS score has been assigned yet.

CISO Take

Open WebUI, a self-hosted LLM chat platform, shipped a channel-members endpoint (GET /api/v1/channels/{id}/members) that returned the complete UserModelResponse object for every member instead of a filtered profile, exposing other users' settings.ui.toolServers[].key values and webhook configuration to any authenticated channel participant. This is not a remote, unauthenticated bug — EPSS sits at 0.00259 (top 83% percentile, i.e. low real-world exploitation pressure), there's no CISA KEV listing, no public PoC, and no Nuclei template — but the blast radius inside an affected deployment is meaningful because toolServers[].key are live credentials for external MCP/tool-server integrations and webhook config can carry callback secrets. Any org running multi-user Open WebUI channels for collaborative AI workflows should treat this as a lateral-movement primitive: one low-privilege channel member can harvest another user's tool-integration credentials without any special AI expertise. Upgrade to open-webui 0.10.0 immediately; until then, restrict channel membership to trusted users and rotate any toolServer keys or webhook secrets that may have transited shared channels, then audit access logs for repeated or anomalous calls to the /channels/*/members endpoint.

Sources: NVD GitHub Advisory EPSS ATLAS

What is the risk?

Severity is rated medium and CVSS is not published, but the practical risk is broken access control (CWE-200) with a trivial exploitation path: no special tooling, no AI/ML knowledge, and no privilege escalation is required beyond being a normal member of a shared channel. The low EPSS score and absence from CISA KEV indicate this is not being mass-exploited in the wild, and there is no public exploit or scanner template, which lowers near-term opportunistic risk. However, exposure is amplified in any org that uses Open WebUI as a shared, multi-tenant front-end for AI agent tooling, since the leaked toolServers[].key values are functioning credentials rather than metadata — turning an information-disclosure bug into a credential-theft vector with downstream access to whatever external tool servers those keys authorize.

How does the attack unfold?

Initial Access

Attacker holds or obtains legitimate low-privilege membership in a shared Open WebUI channel.

AML.T0012

Discovery

Attacker calls GET /api/v1/channels/{id}/members and receives full UserModelResponse objects for all co-members instead of filtered profiles.

AML.T0084.001

Credential Harvesting

Attacker extracts other users' settings.ui.toolServers[].key values and webhook configuration from the response.

AML.T0083

Impact

Attacker reuses the stolen tool-server keys or webhook secrets to access external integrations or forge calls on behalf of the victim user.

AML.T0091.000

Initial Access

Attacker holds or obtains legitimate low-privilege membership in a shared Open WebUI channel.

AML.T0012

Discovery

Attacker calls GET /api/v1/channels/{id}/members and receives full UserModelResponse objects for all co-members instead of filtered profiles.

AML.T0084.001

Credential Harvesting

Attacker extracts other users' settings.ui.toolServers[].key values and webhook configuration from the response.

AML.T0083

Impact

Attacker reuses the stolen tool-server keys or webhook secrets to access external integrations or forge calls on behalf of the victim user.

AML.T0091.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	>= 0.7.0, < 0.10.0	`0.10.0`
149.6K 4 dependents Pushed 3d ago 81% patched ~6d to patch Full package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

Upgrade Open WebUI to version 0.10.0 or later, which fixes the endpoint to stop returning full UserModelResponse objects for channel members. Until upgraded, restrict who can join or be added to channels, and treat any existing toolServer API keys or webhook secrets configured by users in shared channels as potentially exposed — rotate them proactively. Review reverse-proxy/application logs for repeated calls to GET /api/v1/channels/{id}/members from non-admin accounts as a detection signal, and audit which external tool servers/webhooks are reachable with the affected credentials to scope any downstream exposure.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Auth Bypass Privacy Violation Plugin Agent API AML.T0055 - Unsecured Credentials AML.T0083 - Credentials from AI Agent Configuration AML.T0084.001 - Tool Definitions

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.4 - Information security controls for the AI system

NIST AI RMF

MANAGE 4.1 - Risk monitoring and response for deployed AI systems

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-59222?

Open WebUI, a self-hosted LLM chat platform, shipped a channel-members endpoint (GET /api/v1/channels/{id}/members) that returned the complete UserModelResponse object for every member instead of a filtered profile, exposing other users' settings.ui.toolServers[].key values and webhook configuration to any authenticated channel participant. This is not a remote, unauthenticated bug — EPSS sits at 0.00259 (top 83% percentile, i.e. low real-world exploitation pressure), there's no CISA KEV listing, no public PoC, and no Nuclei template — but the blast radius inside an affected deployment is meaningful because toolServers[].key are live credentials for external MCP/tool-server integrations and webhook config can carry callback secrets. Any org running multi-user Open WebUI channels for collaborative AI workflows should treat this as a lateral-movement primitive: one low-privilege channel member can harvest another user's tool-integration credentials without any special AI expertise. Upgrade to open-webui 0.10.0 immediately; until then, restrict channel membership to trusted users and rotate any toolServer keys or webhook secrets that may have transited shared channels, then audit access logs for repeated or anomalous calls to the /channels/*/members endpoint.

Is CVE-2026-59222 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-59222, increasing the risk of exploitation.

How to fix CVE-2026-59222?

Upgrade Open WebUI to version 0.10.0 or later, which fixes the endpoint to stop returning full UserModelResponse objects for channel members. Until upgraded, restrict who can join or be added to channels, and treat any existing toolServer API keys or webhook secrets configured by users in shared channels as potentially exposed — rotate them proactively. Review reverse-proxy/application logs for repeated calls to GET /api/v1/channels/{id}/members from non-admin accounts as a detection signal, and audit which external tool servers/webhooks are reachable with the affected credentials to scope any downstream exposure.

What systems are affected by CVE-2026-59222?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, self-hosted LLM chat/gateway platforms, multi-user collaboration layers.

What is the CVSS score for CVE-2026-59222?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksself-hosted LLM chat/gateway platformsmulti-user collaboration layers

MITRE ATLAS Techniques

AML.T0055 Unsecured Credentials

AML.T0083 Credentials from AI Agent Configuration

AML.T0084.001 Tool Definitions

Compliance Controls Affected

ISO 42001: A.6.2.4

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 before 0.10.0, GET /api/v1/channels//members returned full UserModelResponse objects for channel members, including settings.ui.toolServers[].key and webhook configuration, allowing a normal channel participant to retrieve other users’ sensitive settings. This issue is fixed in version 0.10.0.

Exploitation Scenario

An attacker who is (or becomes) a legitimate low-privilege member of any shared channel in an Open WebUI instance calls GET /api/v1/channels/{channel_id}/members. Instead of a minimal member list, the response includes the full UserModelResponse for every other member, including their settings.ui.toolServers[].key values and webhook configuration. The attacker extracts these credentials and webhook secrets belonging to higher-privileged or unrelated users, then uses the stolen toolServer keys to authenticate directly against the external tool/MCP servers those keys were meant to protect, or forges webhook calls using the exposed configuration — achieving unauthorized data access or lateral movement without ever touching the vulnerable user's account directly.

Weaknesses (CWE)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Primary CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.