---
id: "CVE-2026-109293"
page: "https://infrastack.ai/live/CVE-2026-109293"
kind: "vulnerability"
aliases: ["CVE-2026-109293", "GHSA-2h26-836q-4jh2"]
title: "Tool source code disclosed to read-only users via the tool export endpoint"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "open-webui", "fixed": ["0.11.4"], "affected": ">= 0.11.0, < 0.11.4", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["ai-tooling", "cwe-200", "open-webui", "python", "self-hosted"]
not_affected_if: ["managed-hosting", "no-read-only-tool-shares", "tools-export-admin-only"]
published_at: "2026-09-27T15:58:57+00:00"
first_seen_at: "2026-11-09T22:53:26+00:00"
updated_at: "2026-11-09T23:10:12+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-2h26-836q-4jh2", "first_seen_at": "2026-11-09T22:53:26+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109293", "first_seen_at": "2026-11-09T23:10:12+00:00"}]
exploit_sources: []
---

# Tool source code disclosed to read-only users via the tool export endpoint

Link for people: https://infrastack.ai/live/CVE-2026-109293 (this .md is for agents)

Open WebUI's tool export endpoint returned the full Python source of every tool shared read-only with a non-admin user, including any embedded API keys or credentials. An authenticated non-admin with tool export permission can read that source, but cannot modify or run the tools.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:open-webui affected >= 0.11.0, < 0.11.4 fixed 0.11.4

## How to check

- Check the installed version with `pip show open-webui` and confirm whether it is between `0.11.0` and `0.11.3`.
- Check whether non-admin users hold the `workspace.tools_export` permission, set by `USER_PERMISSIONS_WORKSPACE_TOOLS_EXPORT` or in default or group permissions.
- Check whether any tools owned by one user are shared read-only with other users, groups or all users.

## Fix

- `open-webui` `0.11.4` (fixed version per the product data)

## Timeline

- 2026-11-09T22:53:26+00:00 ghsa-repo https://github.com/open-webui/open-webui/security/advisories/GHSA-2h26-836q-4jh2
- 2026-11-09T23:10:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109293

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/open-webui/open-webui/security/advisories/GHSA-2h26-836q-4jh2
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/open-webui-0.11.0-before-0.11.4-tool-source-disclosure-via-tool-export-endpoint

## From the sources

# Tool source code disclosed to read-only users via the tool export endpoint

## Summary
A user allowed to export tools received the full Python source of every tool that had merely been shared with them for reading. Since 0.11.0 tool source is writer-only: a read-only recipient can use a shared tool, and the tool's detail view withholds its source from them. The bulk export returned it anyway, because it selected every tool the caller could read.

## Preconditions
- Authentication enabled (`WEBUI_AUTH=true`, default) and plugins enabled (`ENABLE_PLUGINS=true`, default).
- The attacker is an authenticated non-admin who holds the tool export permission (`workspace.tools_export`, off by default, set with `USER_PERMISSIONS_WORKSPACE_TOOLS_EXPORT` or granted by an admin in default or group permissions).
- A tool owned by someone else is shared with a read grant to the attacker, to one of their groups, or to all users.

Deployments that never grant the tool export permission to non-admins, or that share tools only with users who already hold write access, are not affected.

## Impact
A non-admin with export rights obtains the server-side source of every tool shared with them read-only, in one request. Tool source commonly embeds API keys, credentials and internal service URLs, so the loss often reaches beyond the code itself. Confidentiality only: the export grants no ability to modify or run tools, and has no integrity or availability impact.

## Fix
Fixed in 0.11.4 by #29310. The export now returns only tools the caller owns or holds write access to, the same scope the per-tool export and the model export already used. Upgrading fully resolves the issue with no configuration change.

## Root cause
Affected component: `GET /api/v1/tools/export` in `backend/open_webui/routers/tools.py`. Affected setup: releases 0.11.0 through 0.11.3. Tool export has been open to non-admins since 0.6.37, but before 0.11.0 a read-only recipient could already read a shared tool's source in its detail view, so the export disclosed nothing beyond that.

The export response deliberately includes each tool's source, since exporting is how a writer takes a copy of their tools. The handler, however, built its list with the default read scope of the tool query, so every tool shared read-only with the caller was exported with its source. When 0.11.0 made source writer-only on the detail endpoint, the export path was left on the read scope and kept returning it.

## Proof of concept
Against a fresh instance, with an admin and a second account `bob` of role `user`:

1. As the admin, enable tool export for users (`POST /api/v1/users/default/permissions` with `workspace.tools_export: true`).
2. As the admin, create a tool whose source contains a marker and share it read-only with bob:

```
POST /api/v1/tools/create
{"id": "readtool", "name": "Read Tool",
 "content": "API_KEY = \"TOOL_SRC_SECRET\"\nclass Tools:\n    def hello(self) -> str:\n        return 'hi'\n",
 "meta": {"description": "poc"},
 "access_grants": [{"principal_type": "user", "principal_id": "<bob id>", "permission": "read"}]}
```

3. As bob:

```
GET /api/v1/tools/id/readtool  -> 200, no content field
GET /api/v1/tools/export       -> 200, [{"id": "readtool", "content": "API_KEY = \"TOOL_SRC_SECRET\" ...", ...}]
```

On 0.11.4 the same export returns only tools bob owns or can write, and `readtool` is absent, while the admin still exports it.

## Credits
- gigioneggiando: reported the source disclosure through the tool export endpoint.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_