CVE-2026-0766: RCE in Open WebUI 0.6.32

An attacker exploiting CVE-2026-0766 can execute arbitrary code on the affected Open WebUI instance. Given that Open WebUI is often used for managing network devices, this could lead to complete control over those devices. Attackers could potentially modify configurations, steal sensitive data (credentials, device settings), or use the compromised device as a pivot point to attack other systems on the network. The ability to execute code in the context of the service account amplifies the potential damage, as this account may have elevated privileges. This vulnerability shares similarities with command injection flaws where untrusted input is directly incorporated into system commands.

1. Reserved2026-01-08
2. Published2026-01-23
3. Modified2026-02-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-0766 is to upgrade to a patched version of Open WebUI as soon as it becomes available. Until a patch is released, restrict access to the Open WebUI interface to only trusted users and networks. Implement strict input validation on all user-supplied data within the loadtoolmodulebyid function as a temporary workaround, although this requires significant code modification. Monitor system logs and network traffic for any suspicious activity, particularly attempts to execute unusual commands or access sensitive files. Consider implementing a Web Application Firewall (WAF) to filter potentially malicious requests. After upgrade, confirm functionality by testing key features and verifying that the loadtoolmodulebyid function no longer accepts arbitrary code execution.