Open WebUI CVE-2026-45351

Exploitation requires valid authentication as a regular (non-admin) user of the Open WebUI application. The application must have been configured with system prompts via the admin models page, and the user must have an active JWT bearer token. Default Open WebUI installations with multi-user support are vulnerable if any non-admin user account exists. Single-user or fully air-gapped deployments are vulnerable if accessed over the network by the authenticated user. No special configuration, non-default feature enablement, or protocol version requirement is involved - the vulnerability exists in the default, standard deployment. The limiting factor is the PR:L authentication requirement; completely unauthenticated attackers cannot trigger the endpoint directly, but any authenticated user (including low-privilege test accounts, temporary contractors, or compromised credentials) can exploit it. In contrast to network-exposed LLM endpoints that may accept anonymous requests, this requires breach or creation of a user account first.

CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates moderate-to-high confidentiality risk with network accessibility and low attack complexity, requiring only valid user credentials. The CVSS vector confirms authenticated network-based exploitation without user interaction required. Real-world risk is elevated by three factors: (1) the proof-of-concept is trivial (single HTTP GET request with valid JWT), requiring no special tools or knowledge; (2) the vulnerability affects all authenticated users in multi-user deployments, meaning any employee, contractor, or guest account gains access to all system prompts; (3) system prompts often contain sensitive operational instructions, jailbreak mitigations, and backend integration details that directly enable prompt injection attacks and model behavior manipulation. However, risk is constrained by the PR:L requirement (authenticated access only) - unauthenticated attackers cannot exploit this directly. In organizations with tightly controlled user access or single-user/self-hosted deployments, impact is lower; in shared workspace models with many users, impact is severe. The OWASP LLM07:2025 classification and MITRE ATLAS mapping confirm this aligns with adversary techniques for discovering LLM system prompts (AML.T0069.002), a known precursor to prompt injection and model jailbreaking attacks.

A contractor or employee with a regular user account logs into the Open WebUI application. Upon login, the browser automatically initiates an HTTP GET request to /api/models with a valid JWT bearer token in the Authorization header. The response includes a JSON array of all configured models with their system_prompt fields intact, exposing, for example, instructions like 'You are a customer service assistant; never disclose pricing tiers' or 'Always validate requests against the internal security policy document at [URL]'. The attacker can now (1) extract sensitive operational logic from the prompts, (2) craft targeted prompt injection attacks knowing the exact guard rails in place, or (3) share the prompts externally if the user account is compromised or the user is malicious. No special tools, user interaction from administrators, or code execution is required - only valid authentication.