CVE-2026-45350: Open WebUI API Flaw Exposes Tools to Unauthorized Access
The National Vulnerability Database has detailed CVE-2026-45350, a significant vulnerability in Open WebUI, a self-hosted AI platform. Versions prior to 0.8.6 are susceptible to unauthorized tool invocation via the chat completion API. Attackers can bypass tool restrictions by manipulating tool_ids and tool_servers parameters, enabling them to execute tools with server-level privileges.
This flaw, rated 7.1 (HIGH severity), is a critical authorization bypass (CWE-862). The core issue is a lack of permission checks: the API does not verify if the user invoking a tool has the necessary authorization. Critically, the server’s own authentication token is used for these invoked tools, meaning an attacker effectively gains server-privileged access to any configured tool.
For defenders, this is a clear-cut case of privilege escalation waiting to happen. An attacker exploiting this could potentially access sensitive data, modify system configurations, or trigger actions that should be restricted. The National Vulnerability Database confirms this issue is resolved in Open WebUI version 0.8.6. Patching is not optional; it’s an immediate requirement.
What This Means For You
- If your organization uses Open WebUI, you need to check your version immediately. Patch to 0.8.6 or newer without delay. This isn't theoretical; an attacker can effectively run arbitrary commands with server-level privileges if you're exposed.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-45350: Open WebUI Unauthorized Tool Access via Chat Completion API
title: CVE-2026-45350: Open WebUI Unauthorized Tool Access via Chat Completion API
id: scw-2026-05-15-ai-1
status: experimental
level: high
description: |
This rule detects attempts to exploit CVE-2026-45350 by identifying POST requests to the /v1/chat/completions API endpoint that include the parameters 'tool_ids' and 'tool_servers' in the query string. This indicates an attempt to bypass tool restrictions and invoke unauthorized server tools with server privileges, as described in the vulnerability details.
author: SCW Feed Engine (AI-generated)
date: 2026-05-15
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-45350/
tags:
- attack.execution
- attack.t1204.002
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/v1/chat/completions'
cs-method|exact:
- 'POST'
cs-uri-query|contains:
- 'tool_ids'
cs-uri-query|contains:
- 'tool_servers'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-45350 | Auth Bypass | Open WebUI versions prior to 0.8.6 |
| CVE-2026-45350 | Auth Bypass | Open WebUI chat completion API |
| CVE-2026-45350 | Auth Bypass | Bypass tool restrictions via tool_ids and tool_servers parameters in chat_completion API |
| CVE-2026-45350 | Privilege Escalation | Invoking server tools with server privileges via chat_completion API |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 16, 2026 at 01:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
Open WebUI XSS Allows Privilege Escalation to Super Admin
CVE-2026-45665 — Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, a Stored Cross-Site Scripting (XSS) vulnerability exists...
CVE-2026-45351 — Open WebUI is a self-hosted artificial intelligence
CVE-2026-45351 — Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.9, when a regular user [non-admin] logs into...
CVE-2026-45345 — Open WebUI is a self-hosted artificial intelligence
CVE-2026-45345 — Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.5.7, a user can modify another user's model...