CVE-2026-45397— Open WebUI: Unauthenticated RAG Configuration Disclosure
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| open-webui | open-webui | < 0.9.5 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-45397
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Open WebUI: Unauthenticated RAG Configuration Disclosure
Source: NVD (National Vulnerability Database)
Vulnerability Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, GET /api/v1/retrieval/ returns live RAG pipeline configuration to any unauthenticated HTTP client. No Authorization header, cookie, or API key is required. Every adjacent endpoint on the same router (/embedding, /config) is correctly guarded by get_admin_user making this a targeted omission. This vulnerability is fixed in 0.9.5.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
关键功能的认证机制缺失
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| open-webui | open-webui | < 0.9.5 | - |
II. Public POCs for CVE-2026-45397
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45397
请登录查看更多情报信息。
Same Patch Batch · open-webui · 2026-05-15 · 59 CVEs total
| CVE-2026-44551 | 9.1 CRITICAL | Open WebUI: LDAP Empty Password Authentication Bypass |
| CVE-2026-45672 | 8.8 HIGH | Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature g |
| CVE-2026-45315 | 8.7 HIGH | Open WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcripti |
| CVE-2026-44552 | 8.7 HIGH | Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Ena |
| CVE-2026-45331 | 8.5 HIGH | Open WebUI: Full SSRF Vulnerability in the RAG Web Search Feature |
| CVE-2026-45400 | 8.5 HIGH | Open WebUI: Server-Side Request Forgery (SSRF) bypass in `validate_url` |
| CVE-2026-45401 | 8.5 HIGH | Open WebUI: SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints |
| CVE-2026-44570 | 8.3 HIGH | Open WebUI: Inconsistent authorization controls within memories API |
| CVE-2026-44565 | 8.1 HIGH | Open WebUI: Open WebUI Arbitrary File Write, Delete via Path Traversal |
| CVE-2026-44553 | 8.1 HIGH | Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User No |
| CVE-2026-45675 | 8.1 HIGH | Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts |
| CVE-2026-44554 | 8.1 HIGH | Open WebUI: Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overw |
| CVE-2026-45301 | 8.1 HIGH | Open WebUI: Missing permission check in files API allows authenticated users to list, acce |
| CVE-2026-45665 | 8.1 HIGH | Open WebUI: Stored XSS in Banner Component via Improper Sanitization Order |
| CVE-2026-45402 | 8.1 HIGH | Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge |
| CVE-2026-45671 | 8.0 HIGH | Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion |
| CVE-2026-45303 | 7.7 HIGH | Open WebUI: Stored XSS via the HTML renedering view |
| CVE-2026-45338 | 7.7 HIGH | Open WebUI: SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py) |
| CVE-2026-44555 | 7.6 HIGH | Open WebUI: Base Model Routing Bypasses Access Control via Model Chaining |
| CVE-2026-45398 | 7.5 HIGH | Open WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls |
Showing top 20 of 59 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: open-webui
- CVE-2026-45338
Open WebUI: SSRF via OAuth Profile Picture URL in _process_p - CVE-2026-44549
Open WebUI: Stored XSS in excel file preview - CVE-2026-45299
Open WebUI: Stored Cross-Site Scripting In Profile Picture - CVE-2026-45665
Open WebUI: Stored XSS in Banner Component via Improper Sani - CVE-2026-45667
Open WebUI: Unauthenticated endpoint can trigger embedding g
Same vendor: open-webui
- CVE-2026-45338
Open WebUI: SSRF via OAuth Profile Picture URL in _process_p - CVE-2026-44549
Open WebUI: Stored XSS in excel file preview - CVE-2026-45299
Open WebUI: Stored Cross-Site Scripting In Profile Picture - CVE-2026-45665
Open WebUI: Stored XSS in Banner Component via Improper Sani - CVE-2026-45667
Open WebUI: Unauthenticated endpoint can trigger embedding g
Same weakness: CWE-306
- CVE-2026-45248
Hedera Guardian Authentication Bypass Information Disclosure - CVE-2026-44592
Gradient: Unauthenticated worker on /proto → arbitrary NAR w - CVE-2026-42283
DevSpace UI Server WebSocket CheckOrigin does not validate s - CVE-2025-62619
KVM漏洞：密钥下载接口缺少认证致敏感信息泄露 - CVE-2026-0247
Prisma Access Agent Endpoint DLP: Authorization Bypass Vulne
V. Comments for CVE-2026-45397
No comments yet