Open WebUI load_tool_module_by_id Command Injection Remote Code Execution Vulnerability

The impact of CVE-2026-0766 is severe due to its RCE nature. A successful exploit allows an attacker to execute commands with the privileges of the Open WebUI service account. This could enable attackers to steal sensitive data, install malware, modify system configurations, or even gain persistent access to the affected system. Given that Open WebUI is often used for managing network devices, a compromise could extend to the entire network infrastructure. The vulnerability's reliance on authentication reduces the immediate attack surface but doesn't eliminate the risk, especially in environments with weak credentials or compromised user accounts. This is similar to other command injection vulnerabilities where attackers can bypass security controls by injecting malicious commands.

Organizations utilizing Open WebUI for network device management are at risk, particularly those relying on version 0.6.32. Shared hosting environments where multiple users share the same Open WebUI instance are also vulnerable, as a compromised account could be used to exploit the vulnerability and gain access to other users' devices. Legacy configurations with default credentials or weak access controls further exacerbate the risk.

• linux / server:

journalctl -u openwebui -g 'load_tool_module_by_id'

• generic web:

curl -I http://<openwebui_ip>/api/v1/tools/load_tool_module_by_id?module_id=<suspicious_input>

• generic web: Grep access/error logs for requests containing suspicious characters or patterns within the module_id parameter. Look for unusual Python code execution attempts.

1. 2026-01-23Disclosure

   disclosure

1. Reserviert2026-01-08
2. Veröffentlicht2026-01-23
3. Geändert2026-02-26
4. EPSS aktualisiert2026-03-23

As a fix for CVE-2026-0766 is pending, immediate mitigation steps are crucial. First, restrict access to Open WebUI to only authorized personnel and enforce strong password policies. Implement a Web Application Firewall (WAF) with rules to detect and block command injection attempts targeting the loadtoolmodulebyid endpoint. Consider temporarily disabling the functionality if possible. Monitor system logs for suspicious activity, particularly commands executed by the Open WebUI service account. While a direct patch is unavailable, regularly check the Open WebUI project's website and security advisories for updates. After any configuration changes or WAF rule implementation, verify the mitigation by attempting to trigger the vulnerable function with a benign command to ensure it is properly blocked.