Security1 hOctober 30, 2026, 07:40

Open WebUI API keys inherit full permissions of their creator

Open WebUI's documentation confirms that an API key inherits the full permissions of the user who created it, while endpoint restrictions apply to the whole deployment rather than each key. ZoomEye counted 92,509 exposed Open WebUI instances. Keys do not expire automatically, and each account holds only one key.

DEV Community

Open source

Open WebUI API keys inherit full permissions of their creator

An Open WebUI API key is a delegated user identity, not a narrow service token
ZoomEye returned 92,509 matches for app="Open WebUI" as of 29 October 2026
Keys do not expire automatically and each account holds one key
Separate least-privilege accounts per integration are recommended

#OpenWebUI#ZoomEye

Open WebUI before 0.11.4: any site could steal your session token

Open WebUI adds native MCP tool routing

Gadgets

Dell XPS 16 Creator Edition review: RTX Spark N1X runs at full speed in a 17.8mm chassis

Security

Open WebUI API keys inherit full permissions of their creator

Open WebUI before 0.11.4: any site could steal your session token

Open WebUI adds native MCP tool routing

Dell XPS 16 Creator Edition review: RTX Spark N1X runs at full speed in a 17.8mm chassis

MLflow flaw leaks plaintext LLM API keys via CrewAI autologging