CVE-2026-0766
📋 TL;DR
This vulnerability allows authenticated remote attackers to execute arbitrary Python code on Open WebUI installations via command injection in the load_tool_module_by_id function. Attackers can gain code execution with the privileges of the Open WebUI service account. All Open WebUI deployments using vulnerable versions are affected.
💻 Affected Systems
- Open WebUI
📦 What is this software?
Open Webui by Openwebui
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary commands, install malware, pivot to other systems, and exfiltrate sensitive data.
Likely Case
Unauthorized code execution leading to data theft, service disruption, and potential lateral movement within the network.
If Mitigated
Limited impact due to network segmentation, minimal service privileges, and proper authentication controls.
🎯 Exploit Status
Authentication required but exploit is straightforward once authenticated. ZDI has published advisory details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific version
Vendor Advisory: https://github.com/open-webui/open-webui/security/advisories
Restart Required: Yes
Instructions:
1. Check current Open WebUI version. 2. Update to the latest patched version from official repository. 3. Restart the Open WebUI service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable vulnerable functionality
allTemporarily disable or restrict access to the load_tool_module_by_id function if not required
Network segmentation
allRestrict network access to Open WebUI to only trusted sources
🧯 If You Can't Patch
- Implement strict authentication controls and monitor for suspicious authentication attempts
- Deploy network segmentation and firewall rules to limit access to Open WebUI instances
🔍 How to Verify
Check if Vulnerable:
Check Open WebUI version against vendor advisory. Review if load_tool_module_by_id function exists and is accessible.Check Version:
Check Open WebUI web interface or configuration files for version informationVerify Fix Applied:
Verify Open WebUI version is updated to patched version. Test that command injection attempts are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual Python code execution attempts
- Suspicious authentication patterns
- Abnormal tool module loading
Network Indicators:
- Unusual outbound connections from Open WebUI service
- Traffic to unexpected destinations
SIEM Query:
source="openwebui" AND (event="command_execution" OR event="module_load") AND payload CONTAINS suspicious_pattern