CVE-2025-63681
📋 TL;DR
Open WebUI v0.6.33 has an access control vulnerability where the /api/tasks/stop/ endpoint allows any authenticated user to cancel arbitrary LLM response tasks without ownership verification. This affects all deployments using the vulnerable version, allowing normal users to disrupt other users' tasks.
💻 Affected Systems
- open-webui
📦 What is this software?
Open Webui by Openwebui
⚠️ Risk & Real-World Impact
Worst Case
Malicious users could systematically cancel all ongoing LLM tasks, causing widespread service disruption and denial of service for legitimate users.
Likely Case
Users accidentally or intentionally cancel other users' tasks, causing minor disruptions and frustration in shared environments.
If Mitigated
With proper access controls, only task owners or administrators can cancel tasks, preventing unauthorized interference.
🎯 Exploit Status
Exploitation requires authenticated access but is trivial with a simple API call. Public proof-of-concept exists in GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check latest open-webui releases (likely v0.6.34+)
Vendor Advisory: https://github.com/open-webui/open-webui/security/advisories
Restart Required: Yes
Instructions:
1. Check current version with 'pip show open-webui' or version file
2. Update to latest version: 'pip install --upgrade open-webui'
3. Restart the open-webui service
4. Verify fix by testing task ownership verification
🔧 Temporary Workarounds
API Endpoint Restriction
allTemporarily restrict access to /api/tasks/stop/ endpoint using web server or application firewall rules
nginx: location /api/tasks/stop/ { deny all; }
apache: <Location /api/tasks/stop/> Require all denied </Location>
Authentication Middleware
allImplement custom middleware to verify task ownership before processing stop requests
Add ownership check in main.py before line 1652
🧯 If You Can't Patch
- Implement network segmentation to isolate open-webui instances from untrusted users
- Monitor and alert on unusual patterns of task cancellation requests from single users
🔍 How to Verify
Check if Vulnerable:
Test if authenticated user can cancel another user's task via POST to /api/tasks/stop/ with arbitrary task IDCheck Version:
pip show open-webui | grep VersionVerify Fix Applied:
Verify that task cancellation now requires ownership verification and returns appropriate error for unauthorized attempts📡 Detection & Monitoring
Log Indicators:
- Multiple 200/204 responses to /api/tasks/stop/ from single user
- Failed task cancellation attempts after patching
Network Indicators:
- Unusual frequency of POST requests to /api/tasks/stop/ endpoint
- Task cancellation requests with varying task IDs from same source
SIEM Query:
source="open-webui" AND path="/api/tasks/stop/" AND status=200 | stats count by src_ip, user