ACVE-2026-0406

In the wild

exploited-itw · 2025-06-02 – 2025-06-02 · vendor

Description

What

Sysdig described an exposed Open WebUI installation where open registration and public tool functionality enabled an AI-generated loader. The chain installed mining components and a stealer. The reported sample counts are exposure telemetry; the confirmed customer incident is the exploitation evidence for this record.

Which configuration is exposed

The exposed configuration is Open WebUI with WEBUI_AUTH disabled or an equivalent no-auth boundary while tool upload or execution functionality remains reachable. Binding the interface publicly increases the attack surface, but a scan count alone is not treated as a victim count.

How ACVE detects it

ACVE checks the Open WebUI harness and the discovered WEBUI_AUTH.set feature. Static discovery does not probe the service, upload tools, or infer whether a firewall blocks it. Missing authentication state is possible rather than clean.

Fix

Enable authentication, bind the interface to a private address, restrict tool uploads, and rotate credentials stored in the instance. Remove miners and stealer persistence from affected hosts and inspect outbound Discord or wallet-related traffic.

Grounding needed

The Sysdig incident page should be checked for the customer evidence and exact configuration language. Exposure counts from the same source remain sample telemetry and are not promoted to global victim totals.

This record is limited to the condition named in the public source: Public Open WebUI tools enabled a cryptojacking and stealer chain. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

and
  harness.id eq "open-webui"
  features["WEBUI_AUTH.set"] eq false

Fix

Enable Open WebUI authentication and keep the service private.

• Reconfigure WEBUI_AUTH to true. Require authentication.
• Reconfigure surface to loopback. Do not expose tool upload routes publicly.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

No references recorded.