Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-87017 medium CVSS 4.3

Information Disclosure in open-webui (CVE-2026-87017)

Summary

Vulnerability in open-webui (CVE-2026-87017). Risk of unauthorized operations or information disclosure. Exploitable via VECTOR_DB. Mitigation: upgrade to 0.11.1 or later.

Original description

The description as published by the source.

Summary

The built-in knowledge search tool returns knowledge bases the calling user has no access to. The tool works out which knowledge bases the caller may read and hands that set to the vector store as a search filter, and that filter is the only access control on the path. Most of the shipped vector backends accept the filter argument on their search method and never apply it, so the search returns matches from every knowledge base in the shared collection. The sibling query method on those same backends does apply a filter, which is why the omission is invisible from the calling code.

Preconditions

  • The deployment must use one of the affected vector backends, selected with VECTOR_DB, which defaults to chroma. Chroma applies the filter, so a default deployment is not affected.
  • Eleven of the fifteen shipped backends ignore the filter: both Qdrant clients, Elasticsearch, OpenSearch, both Milvus clients, openGauss, Oracle 23ai, Pinecone, S3 Vectors and Weaviate. Chroma, pgvector, MariaDB and Valkey apply it and were never affected.
  • The caller needs a model that can call tools, with the knowledge built-in tools left enabled, which is the default, and with no knowledge attached to the model itself. No elevated role or permission is required.
  • At least one knowledge base must exist that the caller cannot otherwise read.

Impact

A user receives the identifier, name and description of knowledge bases that were never shared with them, and chooses how many resul…

Source: NIST National Vulnerability Database NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-87017 has been found in open-webui.
Attackers can target a specific entry point like VECTOR_DB over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 4.3/10.
What to do: upgrade open-webui to 0.11.1 or later.
If unsure, ask your IT team or search "open-webui CVE-2026-87017" on the vendor's site.

CVE-2026-87017 (open-webui) — CWE-200 / CVSS v3 4.3
Attack vector: remote (network-reachable) / no user interaction
Attack surface: VECTOR_DB / chroma
Patched: 0.11.1 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

Information disclosure (CWE-200) exists in open-webui. Attackers reach the vulnerable code path via VECTOR_DB.

📍 Affected scope

Check the vendor advisory for the affected versions of open-webui. Attack surface: VECTOR_DB / chroma.

🔥 Severity

Severity: Medium (CVSS 4.3/10). Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 0.11.1.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'open-webui' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'open-webui' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で open-webui を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply patch patch 
    Upgrade open-webui to 0.11.1

    ステージング環境で 0.11.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  3. 3
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

pip open-webui
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.1"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details