CVE-2026-34222

| EUVD-2026-17977 HIGH
2026-04-01 GitHub_M GHSA-7429-hxcv-268m
7.7
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

4
Patch Released
Apr 02, 2026 - 02:30 nvd
Patch available
EUVD ID Assigned
Apr 01, 2026 - 17:30 euvd
EUVD-2026-17977
Analysis Generated
Apr 01, 2026 - 17:30 vuln.today
CVE Published
Apr 01, 2026 - 17:02 nvd
HIGH 7.7

Tags

Authentication Bypass

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.11, there is a broken access control vulnerability in tool values. This issue has been patched in version 0.8.11.

Analysis

Broken access control in Open WebUI allows authenticated users to access tool values across tenant boundaries, exposing sensitive information from other users' AI tool configurations. The vulnerability affects self-hosted Open WebUI instances prior to version 0.8.11. …

Sign in for full analysis, threat intelligence, and remediation guidance.

Remediation

Within 24 hours: Identify all Open WebUI instances in your environment and document their current versions. Within 7 days: Upgrade all self-hosted Open WebUI instances to version 0.8.11 or later. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: +0.0
CVSS: +38
POC: 0

Share

CVE-2026-34222 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy