PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45395 open-webui CVE debrief

CVE-2026-45395 describes an authorization flaw in Open WebUI’s tool update endpoint. Prior to version 0.9.5, a user who was supposed to be blocked from tool management could still update an existing tool and trigger execution of changed server-side Python content, bypassing the intended workspace.tools boundary.

Vendor
open-webui
Product
Unknown
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-15
Original CVE updated
2026-05-19
Advisory published
2026-05-15
Advisory updated
2026-05-19

Who should care

Administrators and operators of self-hosted Open WebUI deployments, especially environments that delegate tool management to limited-trust users or rely on workspace.tools permissions to separate roles.

Technical summary

The issue is a missing permission check in POST /api/v1/tools/id/{id}/update. The create endpoint already enforced workspace.tools, but the update endpoint did not. As described in the source advisory and NVD record, this allowed an authenticated user with insufficient tool-management privileges to replace tool content and cause execution, creating an authorization bypass with potential confidentiality, integrity, and availability impact. NVD lists CVSS v3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and CWE-269 / CWE-862.

Defensive priority

High priority for any deployment using Open WebUI tools, because the flaw breaks a documented privilege boundary and can lead to code execution through trusted server-side tool content. Apply the fix in 0.9.5 as soon as practical.

Recommended defensive actions

  • Upgrade Open WebUI to version 0.9.5 or later.
  • Review which users can create or update tools and confirm that only trusted administrators retain that access.
  • Audit recent tool updates for unexpected changes to server-side Python content.
  • Monitor authenticated calls to the tool update endpoint for unusual activity or role misuse.
  • If patching is delayed, temporarily reduce exposure of tool-management functionality to the smallest trusted operator set possible.

Evidence notes

The CVE description states that prior to 0.9.5 the POST /api/v1/tools/id/{id}/update endpoint lacked the workspace.tools permission check present on the create endpoint. The same source says this permitted a user explicitly denied tool management capabilities to replace a tool’s server-side Python content and trigger execution. NVD records the issue with CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H and lists CWE-269 and CWE-862. The fix version is given as 0.9.5.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45395 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45395

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45395 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45395

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.