What is the CVSS score of CVE-2026-34222?

CVE-2026-34222 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Open Webui are affected by CVE-2026-34222?

Open WebUI versions prior to 0.8.11 contain broken access control that allows authenticated users to access AI tool configurations across tenant boundaries, exposing sensitive tool values and…. A patch is available.

How to fix or mitigate CVE-2026-34222?

Within 24 hours: Identify all Open WebUI instances in your environment and document their current versions. Within 7 days: Upgrade all self-hosted Open WebUI instances to version 0.8.11 or later. Within 30 days: Audit access logs for instances still on vulnerable versions to identify any unauthorized cross-tenant tool configuration access; rotate any exposed API keys, credentials, or tool authentication tokens used in affected deployments.

Open Webui CVE-2026-34222

EUVD-2026-17977 HIGH

Improper Authorization (CWE-285)

2026-04-01 GitHub_M

GHSA-7429-hxcv-268m

Authentication Bypass Open Webui

7.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 02, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 01, 2026 - 17:30 euvd

EUVD-2026-17977

Analysis Generated

Apr 01, 2026 - 17:30 vuln.today

CVE Published

Apr 01, 2026 - 17:02 nvd

HIGH 7.7

DescriptionGitHub Advisory

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.11, there is a broken access control vulnerability in tool values. This issue has been patched in version 0.8.11.

AnalysisAI

Broken access control in Open WebUI allows authenticated users to access tool values across tenant boundaries, exposing sensitive information from other users' AI tool configurations. The vulnerability affects self-hosted Open WebUI instances prior to version 0.8.11. With CVSS 7.7 (High) and network-accessible attack vector requiring only low-privilege authentication, this represents a significant confidentiality breach in multi-tenant deployments. No public exploit identified at time of analysis, with EPSS data not yet available for this recent CVE.

Technical ContextAI

Open WebUI is a self-hosted AI platform designed for offline operation, allowing users to configure and manage AI tools and integrations. The vulnerability stems from CWE-285 (Improper Authorization), where the application fails to properly enforce access controls on tool value resources. In the CVSS vector, the 'S:C' (Scope Changed) indicates the vulnerability allows an attacker to impact resources beyond their authorized scope, typical of broken access control issues in multi-tenant systems. The CPE identifier cpe:2.3:a:open-webui:open-webui confirms this affects the Open WebUI application itself. Tool values likely contain configuration data, API keys, credentials, or other sensitive parameters used by AI integrations, making unauthorized access particularly concerning in shared hosting environments.

RemediationAI

Upgrade Open WebUI to version 0.8.11 or later, which contains the patch for this broken access control vulnerability. The patched release is available at https://github.com/open-webui/open-webui/releases/tag/v0.8.11. Organizations should prioritize this upgrade for any multi-user or multi-tenant deployments where tool values may contain sensitive configuration data or credentials. After upgrading, administrators should review access logs for any unauthorized access to tool values and consider rotating any sensitive credentials or API keys that may have been exposed. For deployments that cannot immediately upgrade, consider restricting network access to trusted users only or temporarily limiting the platform to single-user operation until patching is complete.