GHSA-jh9g-8jqw-m2qx: Open WebUI Exposes System Prompt to Regular User [Non-Admin]
- Identifiers
- CVE-2026-45351GHSA-jh9g-8jqw-m2qx
- Published
- Record updated
- Affected
- open-webui <= 0.8.8
- Fixed in
- 0.8.9
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
A regular, non-admin user of Open WebUI v0.6.40 (the "main" branch) can see the system prompts that an admin set for models. The GET /api/models? response, which the application requests automatically at login, includes the system prompt of every available model configured on the workspace models pages. The source states the impact as exposing model instructions and enabling content manipulation of model input and output.
Mitigation
The web response should not reveal the system prompt and related internal or back-end model details to regular users. Only the model name and non-sensitive details should be revealed to them.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- open-webuiPyPILLM dependency since 2024-05-20
Related items
- MediumGitLab critical patches include one for a bug that allows code execution by unauthenticated usersSimilar attack · CSO Online
- HighCVE-2026-115419 - Unintended disclosure of data element to wrong session in Strands Agents SDK A2A ServerSimilar attack · AWS Security Bulletins
- CriticalCVE-2026-114612: LiteLLM admin access via forged credential replay enables MCP stdio commandsSimilar attack · NVD/CVE Database
- LowThird-party evaluators found vulnerabilities in OpenAI monitoring system during test pilotSimilar attack · CNBC Technology
- InfoSomeone hacked the Switch 2 by using an old game and AISimilar attack · The Verge (AI)