Back Cybernews

Malicious campaign targeting vulnerable OpenWebUI servers: technical analysis

Cybernews • March 19, 2026

During an investigation into exposed OpenWebUI servers, the Cybernews research team identified a malicious campaign targeting vulnerable OpenWebUI servers with cryptocurrency miners and Info Stealers.

The malicious campaign exploits insufficient access controls set by individual instance administrators, as well as the “Tools” feature of OpenWebUI for Remote Code Execution.

During this investigation, the research team found two information disclosure vulnerabilities in OpenWebUI due to a lack of access controls for undocumented API routes /api/config and /api/version.

One of these vulnerabilities was previously registered by a different security researcher and assigned the CVE-2025-63391 identifier.

CVE-2025-63391 describes the vulnerability as only affecting OpenWebUI versions up to and including 0.6.32. The Cybernews research team confirmed the vulnerability was still present in version 0.8.8 (the most recent version at the time of the investigation).

Our team reached out to the owners of OpenWebUI – OpenWebUI Inc. in an attempt to disclose the vulnerabilities, but the report was closed without a response.

Both vulnerabilities remain unacknowledged and not fixed by the vendor at the time of publication.

While these vulnerabilities allow for easier identification of misconfigured or outdated servers, it is unclear if the malicious campaign used these vulnerabilities to identify vulnerable servers. Furthermore, these vulnerabilities are not sufficient to execute this malicious campaign, as it requires additional, non-standard configuration changes such as disabling authentication or allowing new signups without additional approval.

Our research team identified 14 different iterations of the malicious scripts infecting OpenWebUI servers, revealing that the threat actor was actively developing their malware and testing it on victims’ servers.

The minor differences between the malicious scripts and the reuse of cryptocurrency wallets and webhooks suggest that a single entity is responsible for all of the detected infections.

Most scripts included version numbers set by the malicious actor, allowing for easier analysis of changes between versions. The fact that there were large gaps in version numbers suggests that our team identified only a subset of the exploited servers, and the history of how the malware was developed is incomplete. Code snippets are included in the report for educational purposes to help detect similar campaigns.

Changes from the known version:

Changes from the known versions:

Includes CPU Architecture detection, adds logic to download an arm64 version of xmrig on arm64 systems running Linux.

Changes from the known versions:

Adds timeouts for web requests, such as sending webhook messages, IP, and GeoIP checks.

Changes from the known versions:

Removes unused “commented out code” and commented out pool configuration for kawpow/ravencoin

Changes from the known versions:

Some of the first versions of the malicious scripts included a commented-out URL to an attacker-controlled Bitbucket account, hosting some of the first versions of the malicious script, as well as compiled binaries for gminer. The first repositories were first uploaded on February 18th, 2025.

Stealer functionality was included in iterations 1-5 for Windows, using a Java archive hosted on the attacker's server, and iterations 12-14, including both Linux and Windows support, all done within the Python payload.

When exporting tools from OpenWebUI, it is also possible to retrieve metadata, such as when the tool was uploaded/created. Based on this, the team was able to map a rough estimate of the duration of the campaign.

First detection: December 1st, 2024, 3:05:44 UTC

Last detection: December 25th, 2025, 8:57:44 UTC

Based on tool upload dates, the fact that some malware versions were missing misdirection or obfuscation techniques, that some identical versions of malware were named differently, while most had the same, long names, it's likely that exploits of publicly accessible OpenWebUI servers were automated, but only partially. Threat actor likely used an automated script that they would change and run periodically with changes.

Python scripts with the following SHA256 checksums:

Cryptocurrency wallets:

“Bulletproof hosting” VPS, used by the Treat Actor:

185.208.159.155 - Hosted in Switzerland, by Global-Data System IT Corporation House of Francis, Room 303, Ile Du Port,, 0000, Mahe, SEYCHELLES, ORG-GSIC1-RIPE

Attacker-controlled Bitbucket account hosting malicious scripts and compiled crypto miner binaries - never observed to be actually used:

Information disclosure via api/config and api/version routes:

Recommendations for OpenWebUI users and instance administrators:

January 7th, 2026: Collecting a list of OpenWebUI servers, indexing api/config endpoints

January 8th, 2026: Identifying malicious Python scripts uploaded to OpenWebUI instances, reversed obfuscation

January 13-15th, 2026: Creating a script to export Tools from vulnerable OpenWebUI instances

January 21st, 2026: Identifying all different variations of malicious scripts, decoded and sorted by script checksum hash

January 27th, 2026: finishing analysing the differences between malicious scripts, order of creation

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OpenWebUI Servers Hijacked for Crypto Mining and Data Theft A malicious campaign has exploited vulnerable OpenWebUI servers, turning them into a network of cryptocurrency mining machines and information stealers. The campaign has been active since late 2024, affecting thousands of publicly accessible OpenWebUI instances due to weak security settings and misconfigurations. Researchers identified 14 different malware versions linked to the campaign, indicating ongoing development by a single threat actor. The attack exploits two information disclosure vulnerabilities, including CVE-2025-63391, which remains unaddressed in the latest OpenWebUI version. Despite attempts to notify OpenWebUI Inc. about the vulnerabilities, no response was received, leaving the issues unresolved. The scope of the impact is significant, with over 15,000 instances identified, primarily in data center hubs across the US, China, Germany, France, and Singapore. The vulnerabilities allow attackers to easily identify misconfigured servers, though additional configuration changes are necessary for successful exploitation. The investigation continues as researchers seek to understand the full extent of the campaign. 2 sources 70

Extracted Entities

Malicious campaign targeting vulnerable OpenWebUI servers: technical analysis

The full story

Extracted Entities

Attack Types (1)

Countries (2)

CVEs (1)

IP Addresses (1)

Malware (2)

MITRE ATT&CK (1)

Platforms (3)