Attackers compromised poorly secured Open WebUI servers and used them to run cryptocurrency miners and, in some cases, steal credentials and other sensitive data, according to researchers at Cybernews.
Open WebUI is a self-hosted interface for interacting with AI models. Among its extensibility features are Tools that can execute Python code on the host server. That capability is intentional, but it becomes dangerous when untrusted users are allowed to create or upload Tools.
Cybernews said the campaign targeted servers where administrators had weakened access controls, such as by disabling authentication or allowing new accounts without administrator approval. Attackers could then abuse the Tools feature to execute malicious Python code.
The researchers identified 14 versions of the malware and traced affected Tools from December 2024 through December 2025, indicating that the campaign evolved over time.
Early versions primarily installed cryptocurrency-mining software on Windows and Linux systems. Later variants added persistence mechanisms and techniques intended to conceal mining processes from administrators.
Some versions eventually expanded into credential theft. Cybernews found malware designed to collect SSH credentials, cloud configuration files, Kubernetes settings, Git and Docker credentials, shell history and other potentially sensitive files. It also searched environment variables and files for passwords, API keys, access tokens and private keys, then attempted to send stolen data through attacker-controlled Discord webhooks.
The campaign did not represent an unauthenticated remote-code-execution vulnerability affecting every Open WebUI installation. Attackers needed access to functionality capable of creating or running Tools, making weak authentication and account controls an important part of the attack path.
During the same investigation, Cybernews identified unauthenticated API routes that exposed Open WebUI configuration and version information. One issue was associated with CVE-2025-63391. Although its original description listed affected releases through version 0.6.32, Cybernews said it reproduced the behavior in version 0.8.8, which was current during the investigation.
Those information disclosures could help attackers identify outdated or weakly configured servers, but Cybernews did not establish that the campaign operators used them to find victims. The exposed metadata alone was also not enough to execute the malicious Tools.
Open WebUI’s security documentation warns that Tools and Functions can access files, environment variables, networks and system commands and recommends limiting their management to trusted users. Its hardening guidance also recommends protecting deployments with measures such as a VPN, zero-trust access service or authenticated reverse proxy instead of exposing them directly to the internet.
Organizations that do not need server-side Tools or Functions can disable plugin execution; those that do should limit who can create or manage them. Deployments should also stay updated, require authentication and account approval, and avoid direct exposure to the public internet. Weak access controls can turn legitimate code-execution features into an easy route for abuse.
Leave a Reply