In Open WebUI versions 0.10.2 and earlier the back‑end API endpoints used to list and retrieve tool definitions returned the full Python source code of the tool to any authenticated user with a read‑only allowance. The tool source often contains embedded API keys, credentials and URLs to internal services, meaning an attacker with read rights can obtain sensitive data that should remain confidential. This weakness is a classic example of CWE‑200, where information is exposed through insufficient access control.

The affected product is Open WebUI (open-webui:open-webui). All releases up to 0.10.2 are impacted; the issue is resolved in v0.11.0 and later. The vulnerability applies to the GET /api/v1/tools/, /api/v1/tools/list, and /api/v1/tools/id/{id} endpoints provided by backend/open_webui/routers/tools.py.

The CVSS score of 6.5 indicates a medium severity event. The EPSS score is not available, and the vulnerability is not currently listed in CISA’s KEV catalog, suggesting limited publicly known exploitation activity. Exploitation requires only an authenticated session with read‑only privileges; thus any user who can log in with such permissions can trigger the information leakage. The attack vector is therefore an authenticated HTTP request to the exposed endpoints. The potential impact is the compromise of API keys and other confidential data, which could enable further attacks on downstream services.