{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0406",
  "aliases": [],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Public Open WebUI tools enabled a cryptojacking and stealer chain",
  "details": "## What\n\nSysdig described an exposed Open WebUI installation where open registration and public tool functionality enabled an AI-generated loader. The chain installed mining components and a stealer. The reported sample counts are exposure telemetry; the confirmed customer incident is the exploitation evidence for this record.\n\n## Which configuration is exposed\n\nThe exposed configuration is Open WebUI with WEBUI_AUTH disabled or an equivalent no-auth boundary while tool upload or execution functionality remains reachable. Binding the interface publicly increases the attack surface, but a scan count alone is not treated as a victim count.\n\n## How ACVE detects it\n\nACVE checks the Open WebUI harness and the discovered WEBUI_AUTH.set feature. Static discovery does not probe the service, upload tools, or infer whether a firewall blocks it. Missing authentication state is possible rather than clean.\n\n## Fix\n\nEnable authentication, bind the interface to a private address, restrict tool uploads, and rotate credentials stored in the instance. Remove miners and stealer persistence from affected hosts and inspect outbound Discord or wallet-related traffic.\n\n## Grounding needed\n\nThe Sysdig incident page should be checked for the customer evidence and exact configuration language. Exposure counts from the same source remain sample telemetry and are not promoted to global victim totals.\n\nThis record is limited to the condition named in the public source: Public Open WebUI tools enabled a cryptojacking and stealer chain. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "open-webui"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "code",
      "vulnClasses": [
        "exposed-surface",
        "command-injection",
        "credential-theft"
      ],
      "cwe": [
        "CWE-522"
      ],
      "exploitation": {
        "status": "exploited-itw",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://www.sysdig.com/blog/attacker-exploits-misconfigured-ai-tool-to-run-ai-generated-payload",
            "type": "vendor"
          }
        ],
        "kev": {
          "listed": false
        },
        "first_seen": "2025-06-02",
        "last_seen": "2025-06-02",
        "victims": {
          "count": 1,
          "range": "sample included 98 unauthenticated instances; 45 showed compromise signs",
          "sectors": [
            "developer/technology"
          ],
          "evidence": "Sysdig describes a customer compromise with a loader, miners, and credential theft."
        },
        "attribution": "unattributed"
      },
      "cveBoundary": "exposed-surface",
      "matcher": {
        "all": [
          {
            "field": "harness.id",
            "op": "eq",
            "value": "open-webui"
          },
          {
            "field": "features[\"WEBUI_AUTH.set\"]",
            "op": "eq",
            "value": false
          }
        ]
      },
      "fix": {
        "summary": "Enable Open WebUI authentication and keep the service private.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "WEBUI_AUTH",
            "to": "true",
            "why": "Require authentication."
          },
          {
            "type": "reconfigure",
            "target": "surface",
            "to": "loopback",
            "why": "Do not expose tool upload routes publicly."
          }
        ]
      },
      "noCveReason": "No CVE assigned; this record describes a configuration or supply-chain condition.",
      "grounding": {
        "itw": {
          "checkedAt": "2026-09-20T16:26:24Z",
          "sources": [
            {
              "url": "https://www.sysdig.com/blog/attacker-exploits-misconfigured-ai-tool-to-run-ai-generated-payload",
              "status": 200,
              "contentType": "text/html; charset=utf-8",
              "sha256": "sha256:7977297bb5eb7f9a611b68fd8bc5d8481a47f65dcaa0ac04d5606b6944d272c9",
              "type": "vendor"
            }
          ],
          "kev": {
            "listed": false
          }
        }
      }
    }
  }
}