Loading story…
Open WebUI disclosed and patched a high-severity broken access control vulnerability in its Tool Valves feature, tracked as CVE-2026-34222 and GHSA-7429-hxcv-268m. The flaw affects versions earlier than v0.8.11 and allowed a low-privileged Member user with a valid authorization token to access sensitive valve configuration data that should have been restricted. According to the disclosure, the vulnerable endpoint did not properly enforce authorization checks, exposing secrets such as API keys used by backend integrations.
SEC Consult reported that exploitation required knowledge of a Tool ID, but said those identifiers were easy to derive because they are based on tool names and imported tools use predictable values. The issue was validated against Open WebUI v0.7.2, and the project confirmed a fix in v0.8.11, with remediation verified on the development branch before coordinated disclosure. Organizations running affected releases should treat Tool Valve secrets as potentially exposed and upgrade to a patched version.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
SEC Consult publicly disclosed a high-severity broken access control issue in Open WebUI on April 1, 2026, after confirming the fix on the development branch. The advisory said a Member-level user with a valid token could retrieve Tool Valve secrets if they knew or could guess the Tool ID.
Open WebUI patched a broken access control vulnerability in the Tool Valves endpoint in version 0.8.11. The flaw, later tracked as CVE-2026-34222, affected versions earlier than v0.8.11 and could expose sensitive valve data such as backend API keys to low-privileged users.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple high-severity vulnerabilities in **Open WebUI** allow attackers to plant malicious chat content that executes when viewed, leading to theft of JWTs and session tokens from `localStorage`, full account takeover, and compromise of sensitive AI assets. The flaws affect markdown rendering, citation and response iframe handling, and HTML file-serving paths, including cases where attacker-controlled content was rendered with dangerous HTML processing or iframe sandbox settings such as `allow-scripts allow-forms allow-same-origin`. Reported impacts include exposure of DOM data, `indexedDB`, cookies, backend API keys, model parameter files, private databases, and other enterprise AI resources. Several reports warn that if an administrator opens a malicious shared transcript or chat, the attack can escalate from stored XSS to **remote code execution** through Open WebUI's administrative features and Python-based functions or plugins, potentially yielding code execution on the Docker container or local host. The issues were addressed across releases including **v0.6.6** and **v0.7.0** by tightening file ownership checks, removing or making optional same-origin iframe access, and recommending stronger HTML sanitization and restrictive CSP settings; one report also provided a database query to hunt for stored chats containing suspicious `data:text/html` or `javascript:` embed payloads.
Jul 7, 2026
Apache disclosed **CVE-2026-59083**, a vulnerability in Tomcat's `RewriteValve` caused by incorrect URL decoding of hex-encoded characters that can let attackers bypass security controls in some configurations. The issue is classified as **CWE-177** and was described as low severity by Apache, though the CVE record notes network attackability with low attack complexity, no privileges required, and no user interaction. Apache said the flaw affects supported Tomcat branches **11.0.0-M1 through 11.0.23**, **10.1.0-M1 through 10.1.56**, and **9.0.0.M1 through 9.0.119**, with reports also listing **8.5.0 through 8.5.100** as affected. Apache and downstream advisories urged users to upgrade to fixed releases **11.0.24**, **10.1.57**, or **9.0.120**, while warning that older unsupported versions may also be vulnerable; versions before **8.0.0** were noted as unaffected in the oss-security disclosure. The vulnerability was published through Apache security pages, the Apache mailing list, and `oss-security`, with the CVE entry updated to include affected-version details, a CVSS v3.1 vector, and a CISA SSVC assessment.
Aug 28, 2026
ToolJet disclosed two serious vulnerabilities affecting versions prior to `3.20.178-lts`, including a critical marketplace plugin poisoning flaw tracked as **CVE-2026-55413**. The bug lets an authenticated user with the builder role overwrite a globally shared marketplace plugin with attacker-controlled JavaScript, which then executes server-side with full Node.js access whenever any user runs a query through the poisoned plugin. The advisory said the weakness stems from weak authorization on the plugin update path, unsafe execution with exposed `require` and `process` objects, and missing integrity checks for plugin code pulled from arbitrary GitHub repositories, creating an instance-wide supply-chain style compromise that persists until the plugin is reverted or reinstalled. ToolJet also fixed **CVE-2026-55412**, a high-severity SSRF issue in the RestAPI data source for ToolJet Cloud that allowed any authenticated user, including free-tier users, to bypass private IP filtering through DNS tricks such as `169.254.169.254.nip.io`. Successful exploitation could reach the Azure Instance Metadata Service and expose managed identity tokens for the production AKS cluster. ToolJet patched both issues in `3.20.178-lts` and advised customers to upgrade, remove or reinstall potentially compromised marketplace plugins, review plugin integrity and source repositories, and verify RestAPI data source IP filtering.
Jun 29, 2026