Offensive Testing
Penetration TestingVulnerability AssessmentsRed Team Engagements
Advisory & Research
AI Launch Risk ReviewSecurity Architecture ReviewSecurity ResearchSecurity Awareness Training
Software
Breachwright
Community
AI Security DatabaseAdvent Prompt PwnField Manual
ResearchAboutContact
Get in Touch
← Back to the database
high · 7.1Maintainer reviewedAASD-2026-0001

Open WebUI chat completion bypasses tool authorization

Open WebUI before 0.8.6 did not consistently verify that a chat-completion API user was authorized to invoke requested local tools or administrator-configured MCP servers. A low-privilege authenticated user could cross the intended tool visibility boundary, and an MCP invocation could use credentials stored by the server for that restricted integration.

Prerequisites

  • The attacker has an authenticated account or API key with chat-completion access
  • A local tool or administrator-configured MCP server is present but not granted to the attacker

Potential impact

  • Invocation of tools or MCP integrations that the caller is not authorized to use
  • Unauthorized actions or data access through credentials stored for a restricted server integration

Mitigations

  • Upgrade Open WebUI to version 0.8.6 or later
  • Review tool and MCP access grants, rotate exposed integration credentials, and restrict integration network reach
  • Disable unnecessary tools and external integrations until the upgrade is complete

Public sources

cve recordvendor advisoryresearchpatchpatch

Research note

The vendor advisory documents separate local-tool and MCP authorization fixes; version 0.8.6 includes both and is the comprehensive fixed version.