russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.1 KiB

Raw Permalink Blame History

Open WebUI — CWE-312 Disclosure Brief (open-webui-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

Configuration sync from Redis logs sensitive values (API keys, tokens, passwords) in plaintext via log.info() when config values change.

The Defect

open-webui-0001 (PATCHED — MEDIUM): backend/open_webui/config.py:266

# Logs decoded config value including secrets:
if self._state[key].value != decoded_value:
    self._state[key].value = decoded_value
    log.info(f'Updated {key} from Redis: {decoded_value}')

When a Redis-backed config value changes, the full decoded value is logged. Config keys containing SECRET, KEY, TOKEN, PASSWORD, or CREDENTIAL expose their values in application logs.

Impact

Open WebUI is a self-hosted web interface for large language models. Configuration stores API keys for model providers (OpenAI, Anthropic, etc.), authentication tokens, and database credentials. These values appear in plaintext in application logs whenever they update from Redis, making them accessible to anyone with log read access.

The Fix

Add a redaction function that checks key names against sensitive substrings:

_SENSITIVE_KEY_SUBSTRINGS = ('SECRET', 'KEY', 'TOKEN', 'PASSWORD', 'CREDENTIAL')

def _redact_config_value(key: str, value):
    if any(s in key.upper() for s in _SENSITIVE_KEY_SUBSTRINGS):
        return '***REDACTED***'
    return value

# Usage
log.info(f'Updated {key} from Redis: {_redact_config_value(key, decoded_value)}')

Patch

Fix available: defects/open-webui-0001/patch/open-webui-0001.patch

Single-file patch in config.py.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (open-webui/open-webui).
Assess severity — credential exposure in application logs during normal operation.
Coordinate a disclosure date — we target 90 days from first contact.
We will credit the Open WebUI team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.1 KiB Raw Permalink Blame History