Listen to this Post
The vulnerability arises from improper access control in the Tool Valves endpoint of Open WebUI. Tools enable LLMs to call external APIs, and Valves store sensitive configuration like API keys—admin-only Valves versus user-configurable UserValves. The flaw occurs when a low-privileged Member user accesses the `/api/v1/tools/id/backend/open_webui/routers/tools.py) fails to verify whether the requesting user has administrative rights, allowing any authenticated user to read Valve data. Tool IDs are predictable because they are derived from the tool name, making enumeration trivial. An attacker with a valid authorization token can thus exfiltrate API keys and other secrets stored in any Tool Valve. This effectively bypasses the admin‑only restriction, turning a configuration feature into a vector for information disclosure. The impact is critical when API keys grant access to third‑party systems.
Platform: Open WebUI
Version: All affected
Vulnerability: Broken Access Control
Severity: High
date: March 2026
Prediction: Patch expected within 14 days
What Undercode Say:
Identify tool IDs by enumerating common tool names for tool in "web_search" "email_fetcher" "db_query"; do curl -s -H "Authorization: Bearer $TOKEN" \ "https://target/api/v1/tools/id/$tool/valves" done
Exploit:
- Obtain a valid JWT as a Member user.
- Guess or retrieve a Tool ID (e.g., from imported tool names).
3. Send `GET /api/v1/tools/id//valves` with the token.
- Extract API keys and secrets from the JSON response.
Protection from this CVE:
- Upgrade to a patched version once released.
- Restrict network access to the Open WebUI API for untrusted users.
- Rotate any API keys that may have been exposed.
- Monitor logs for unauthorized access to
/api/v1/tools/id//valves.
Impact:
Low‑privileged users can read admin‑only Valve data, leading to exposure of API keys, internal credentials, and potential lateral movement into third‑party systems connected via Open WebUI Tools.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
