PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44552 open-webui CVE debrief

CVE-2026-44552 affects Open WebUI deployments that share a Redis database across multiple instances. Prior to version 0.9.0, the tool_servers and terminal_servers keys in utils/tools.py were not prefixed, so values could collide between instances. In supported multi-instance setups, an administrator on one instance could overwrite the configuration read by another instance, causing users on the second instance to receive the first instance’s tool server configuration. The issue is documented as fixed in Open WebUI 0.9.0.

Vendor
open-webui
Product
Unknown
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-15
Original CVE updated
2026-05-18
Advisory published
2026-05-15
Advisory updated
2026-05-18

Who should care

Administrators and operators of Open WebUI, especially those using shared Redis across multiple instances for multi-region, blue-green, or clustered deployments. Security teams should also review environments where instance-to-instance isolation is expected.

Technical summary

The vulnerability is a cross-instance key collision in Redis caused by unprefixed tool_servers and terminal_servers entries in utils/tools.py. When multiple Open WebUI instances use the same Redis database, writes from one instance can replace data read by another. NVD lists the issue as CVSS 3.1 8.7 HIGH with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N and identifies CWE-668. The vulnerable version range ends before 0.9.0.

Defensive priority

High. The issue can cross trust boundaries between separate Open WebUI instances that share Redis, and the impact includes confidentiality and integrity exposure across instances.

Recommended defensive actions

  • Upgrade Open WebUI to version 0.9.0 or later.
  • If immediate upgrading is not possible, stop sharing a Redis database between independent Open WebUI instances until all are patched.
  • Review deployment topology to ensure instance-scoped data is isolated in Redis.
  • Validate that any custom tooling or configuration management does not rely on shared Redis keys between instances.
  • Monitor for unexpected changes in tool server configuration across Open WebUI instances.

Evidence notes

Based on the NVD record, the vulnerability is analyzed, affects cpe:2.3:a:openwebui:open_webui versions before 0.9.0, and references the GitHub Security Advisory GHSA-3x8w-4f7p-xxc2. The CVE description states that unprefixed Redis keys in utils/tools.py can collide when multiple Open WebUI instances share a Redis database, leading to cross-instance configuration overwrite. The CVSS vector provided by NVD is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44552 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44552

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44552 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44552

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.