CVE-2026-59222: Open WebUI Information Disclosure Vulnerability (0.7.0–0.9.x)

Technical summary

The vulnerability exists in the GET /api/v1/channels//members endpoint, which fails to sanitize the UserModelResponse objects returned to requesters. Specifically, nested fields like settings.ui.toolServers[].key and webhook configuration objects are included in the response despite containing secrets that should not be exposed to peer users. The affected versions span from 0.7.0 through 0.9.x, with the flaw remediated in version 0.10.0. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and carries a CVSS v3.1 score of 6.5 (Medium severity), reflecting the requirement for authentication and the confidentiality-only impact.

Business impact

This vulnerability enables lateral privilege escalation within self-hosted Open WebUI instances. An attacker with legitimate channel access can extract API keys, webhook tokens, and integration credentials belonging to other users, potentially granting unauthorized access to downstream systems, APIs, and third-party services connected through Open WebUI. For organizations using Open WebUI to manage AI workflows with sensitive integrations, this represents a supply-chain-like exposure where internal users become vectors for credential theft. Remediation complexity and detection difficulty may delay containment once exploitation begins.

Affected systems

Open WebUI versions 0.7.0, 0.8.x, and 0.9.x are vulnerable. Version 0.10.0 and later patch the issue. Self-hosted deployments are directly at risk; SaaS or cloud-hosted instances depend on the provider's patch status. Organizations should verify their deployment version immediately. The vulnerability requires an authenticated user with channel membership, so internet-facing instances without strong access controls face higher risk.

Exploitability

The attack is straightforward and requires only standard HTTP client tooling. An authenticated user makes a GET request to the channel members endpoint and parses the JSON response for sensitive keys and credentials. No special techniques, race conditions, or bypass logic is required. The attack is reliable and reproducible. However, the requirement for valid channel membership prevents unauthenticated abuse. Detection is possible if API logging captures the request and response payloads, but the endpoint's normal operation may not trigger alerts.

Remediation

Upgrade to Open WebUI version 0.10.0 or later, which excludes sensitive configuration fields from API responses. Before upgrading, review audit logs for suspicious queries to the /api/v1/channels//members endpoint, particularly those targeting users with numerous or sensitive integrations. Rotate any exposed API keys, webhook credentials, and tool server secrets as a precautionary measure if compromise is suspected. Consider implementing network-level controls to restrict API endpoint access to trusted internal networks if applicable.

Patch guidance

Open WebUI version 0.10.0 is the confirmed fixed version. Users on 0.7.0–0.9.x should upgrade immediately. Verify your current version via the Open WebUI admin interface or by checking the deployment manifests and container image tags. If you cannot upgrade immediately, implement compensating controls such as API rate limiting on the /api/v1/channels endpoint and restricted webhook secret storage in external vaults. Test the upgrade in a staging environment to confirm no integration breakage before production rollout.

Detection guidance

Monitor API access logs for repeated or bulk queries to GET /api/v1/channels//members, especially from user accounts with normal channel membership querying data for multiple users. Look for patterns where a single session accesses member lists more frequently than typical usage. Implement alerting on responses containing settings.ui.toolServers or webhook-related fields in the JSON payload. Network intrusion detection rules should flag suspicious patterns. If possible, enable detailed request/response logging for the channels API and periodically review logs for anomalous data exfiltration patterns.

Why prioritize this

Although the CVSS score is 6.5 (Medium), the practical business risk is elevated due to the simplicity of exploitation, the sensitivity of exposed credentials, and the likelihood of downstream compromise. Any organization using Open WebUI with integrated third-party services should prioritize patching to prevent credential theft. The lack of active exploits in the wild (KEV status: not added) provides a window for orderly patching, but the ease of exploitation means opportunistic attackers may quickly adapt once the vulnerability is publicly disclosed or patched codebases are analyzed.

Risk score, explained

The CVSS v3.1 score of 6.5 reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L) that requires valid authentication (PR:L) and results in high confidentiality impact (C:H) but no integrity or availability impact (I:N/A:N). Within a single security domain (S:U), this is a straightforward information disclosure. The score appropriately reflects the sensitivity of exposed secrets but does not account for the downstream impact of compromised credentials; organizations should consider context-specific business risk higher if affected systems integrate with critical infrastructure or high-value APIs.

Frequently asked questions