issue: Built in Tools ignore Model configuration and access ALL Knowledge Bases

[Blenderpics]

Check Existing Issues

• I have searched for any existing and/or related issues.
• I have searched for any existing and/or related discussions.
• I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!).
• I am using the latest version of Open WebUI.

Installation Method

Docker

Open WebUI Version

v0.7.2 (digest: sha256:000b87a6ae726aa7f6611a0064ba528ba1a6aff6ead5fb3b6c89fd4a5717eb8a)

Ollama Version (if applicable)

No response

Operating System

Ubuntu 24.04

Browser (if applicable)

No response

Confirmation

• I have read and followed all instructions in README.md.
• I am using the latest version of both Open WebUI and Ollama.
• I have included the browser console logs.
• I have included the Docker container logs.
• I have provided every relevant configuration, setting, and environment variable used in my setup.
• I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
• I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation. My steps:
• Start with the initial platform/version/OS and dependencies used,
• Specify exact install/launch/configure commands,
• List URLs visited, user input (incl. example values/emails/passwords if needed),
• Describe all options and toggles enabled or changed,
• Include any files or environmental changes,
• Identify the expected and actual result at each stage,
• Ensure any reasonably skilled user can follow and hit the same issue.

Expected Behavior

Models respect their assigned Knowledgebases, even if Tool Calling = native and Built in Tools = true.
Only Knowledgebases that are assigned to the model can be queried by the build in tools.

Actual Behavior

The Model ignores its configuration and searches every Knowledge Base reachable by the user account, returning data it should not have access to.

Steps to Reproduce

1. Setup Data: Create a Knowledge Base (let's call it "KB_Restricted") containing specific information (e.g., a unique phrase like "Project Alpha Secret Code 123").
2. Configure Agent: Create a new Model/Agent settings:
   • Knowledge: Ensure NO Knowledge Bases are selected/attached (or attach a completely unrelated different KB).
   • Capabilities: Enable "Built-in Tools".
   • Tool Calling: Ensure the model supports native tool calling.
3. Permissions: Log in as a user who has access to "KB_Restricted" (via the workspace or specific permissions).
4. Execute: Open a chat with the new Agent and ask: "What is the Project Alpha Secret Code?"
5. Observation: The Agent utilizes the built-in tool (e.g., search_knowledge_files) and correctly returns "123", proving it accessed "KB_Restricted" despite it not being configured for this Agent.

Logs & Screenshots

When "Built-in Tools" is activated for a model, the model gains the ability to query Knowledge Bases. However, the scope of this query is incorrectly set to ALL Knowledge Bases the current user has access to, completely ignoring the specific Knowledge Bases configured (attached) to that model.

We have several models. Some use public hosted LLMs, some use self hosted LLMs.
The public LLMs must not have access to internal company data.
Therefore only the self hosted models use knowledge bases that contain sensitive data.
Due to this bug, even the public models gained access to the knowledge bases they where not supposed to.

This is quite a big deal!

Additional Information

No response

[owui-terminator[bot]]

🔍 Similar Issues Found

I found some existing issues that might be related to this one. Please check if any of these are duplicates or contain helpful solutions:

1. #20703 issue: Some Knowledge Bases dont work(?)
   by Nels2 • Jan 15, 2026 • bug

2. #20568 issue: Custom model did not configure Knowledge but still defaults to calling function
   by ChGoh7 • Jan 11, 2026 • bug

3. #20851 issue: view_knowledge_file builtin tool not injected in Native mode (Builtin Tools enabled)
   by jaza089 • Jan 21, 2026 • bug

4. #20676 issue: Cloud models fail to use native tools
   by 0x7CFE • Jan 15, 2026 • bug

5. #20549 issue: Native tools are injected when models are used over the openwebui API.
   by LysanderdeJong • Jan 10, 2026 • bug

Show 2 more related issues

6. #17514 issue: Workspace Models: Knowledge being ignored when created in older Open WebUI version
   by lindner-tj • Sep 17, 2025 • bug

7. #20641 issue: Web Search and Builtin Tools permissions break search
   by HenkieTenkie62 • Jan 13, 2026 • bug

---

💡 Tips:

• If this is a duplicate, please consider closing this issue and adding any additional details to the existing one
• If you found a solution in any of these issues, please share it here to help others

This comment was generated automatically by a bot. Please react with a 👍 if this comment was helpful, or a 👎 if it was not.

[Classic298]

Models respect their assigned Knowledgebases, even if Tool Calling = native and Built in Tools = true.
Only Knowledgebases that are assigned to the model can be queried by the build in tools.

Why is this expected?
Even if i assign a knowledge base to a model, i can always attach additional knowledge bases to that model using the button in the chat interface.

Actual Behaviour
The Model ignores its configuration and searches every Knowledge Base reachable by the user account, returning data it should not have access to.

As intended - that's what it's supposed to do.

Not a bug.

[Classic298]

"If i disable the knowledge tool in the upcoming version, will native tool calling still be used when assigning knowledge bases?"

No, then the knowledge tool is disabled and the knowledge bases attached by a user will be searched normally.

[Classic298]

So basically you will have the same behaviour as before, as before builtin tools with the safety you wanted

[Classic298]

@Blenderpics what if you create a new EMPTY knowledgebase and add that to the model - according to the user in #21051 the model will then be restrained to only the knowledgebase that is added to the model

that should solve it for you?

[Blenderpics]

Hmm...

I love the fact that open webui now uses "real" native tool calling, but it seems that i won't be able to leverage the new mechanism, at least as long as i can't "blacklist" specific KB for certain models

Don't you think it's confusing for users to provide two completely separate possibilities to set up RAG/Web Search?
I read the changelogs as well as the documentation, and even then the mechanism wasn't entirely clear to me.

What i would find intuitive:

• A checkbox to enable or disable Knowledge Retrieval completely in a model's settings.
• A dropdown (that is only visible when the checkbox above was checked) that allows the user to either select "Retrieve using Task Model" or "Retrieve using Native Tool Calling"
• A dropdown that allows the user to either select "Use all Knowledge available" or "Use specific Knowledge"
• The current GUI to choose Knowledge bases. (will only be visible when "Use specific Knowledge" is selected in the dropdown above)

If "Use specific Knowledge" is choosen, the Knowledge bases are filtered, so the tools provided to the agent are not able to query KB's outside of what was selected

A similar approach could be used with the websearch. (Task Model vs. Native Toolcalling).

(just brainstorming here)

[Classic298]

Adding dropdowns with multiple options here will probably be even more confusing in the UX

I will also brain storm this a bit

[Classic298]

EXTREMELY related: #21051