Tool source code disclosed to read-only users via the tool export endpoint

03 · The fix

Upgrade to 0.11.4

Fixed in 0.11.4 by #29310. The export now returns only tools the caller owns or holds write access to, the same scope the per-tool export and the model export already used. Upgrading fully resolves the issue with no configuration change.

Root cause

Affected component: GET /api/v1/tools/export in backend/open_webui/routers/tools.py. Affected setup: releases 0.11.0 through 0.11.3. Tool export has been open to non-admins since 0.6.37, but before 0.11.0 a read-only recipient could already read a shared tool's source in its detail view, so the export disclosed nothing beyond that.

The export response deliberately includes each tool's source, since exporting is how a writer takes a copy of their tools. The handler, however, built its list with the default read scope of the tool query, so every tool shared read-only with the caller was exported with its source. When 0.11.0 made source writer-only on the detail endpoint, the export path was left on the read scope and kept returning it.

Proof of concept

Against a fresh instance, with an admin and a second account bob of role user:

1. As the admin, enable tool export for users (POST /api/v1/users/default/permissions with workspace.tools_export: true).
2. As the admin, create a tool whose source contains a marker and share it read-only with bob:

POST /api/v1/tools/create
{"id": "readtool", "name": "Read Tool",
 "content": "API_KEY = \"TOOL_SRC_SECRET\"\nclass Tools:\n    def hello(self) -> str:\n        return 'hi'\n",
 "meta": {"description": "poc"},
 "access_grants": [{"principal_type": "user", "principal_id": "<bob id>", "permission": "read"}]}

1. As bob:

GET /api/v1/tools/id/readtool  -> 200, no content field
GET /api/v1/tools/export       -> 200, [{"id": "readtool", "content": "API_KEY = \"TOOL_SRC_SECRET\" ...", ...}]

On 0.11.4 the same export returns only tools bob owns or can write, and readtool is absent, while the admin still exports it.

Credits

• gigioneggiando: reported the source disclosure through the tool export endpoint.