CVE-2026-0765: Open WebUI Command Injection RCE Flaw

CVE-2026-0765 Overview

CVE-2026-0765 is a command injection vulnerability in Open WebUI that allows authenticated remote attackers to execute arbitrary code on affected installations. The flaw resides in the install_frontmatter_requirements function, which passes user-supplied input to a system call without proper validation. Successful exploitation grants code execution in the context of the Open WebUI service account. The issue was reported through the Zero Day Initiative as ZDI-CAN-28258 and tracked as advisory ZDI-26-031. It maps to [CWE-78] OS Command Injection.

Critical Impact

Authenticated attackers can achieve remote code execution on Open WebUI hosts, compromising the service account and any data or AI pipelines it can access.

Affected Products

• Open WebUI version 0.6.32
• Deployments exposing Open WebUI to authenticated users with function or pipeline upload privileges
• Self-hosted Open WebUI instances integrating PIP-based requirement installation

Discovery Timeline

• 2026-01-23 - CVE-2026-0765 published to NVD
• 2026-01-30 - Last updated in NVD database

Technical Details for CVE-2026-0765

Vulnerability Analysis

Open WebUI supports user-authored functions and pipelines whose frontmatter declares Python package dependencies. The install_frontmatter_requirements routine extracts those declared requirements and invokes PIP to install them on the server. Because the routine concatenates user-controlled requirement strings into a shell-executed command without sanitization, attackers can append shell metacharacters or additional arguments that the operating system interprets as commands. The result is arbitrary command execution under the privileges of the Open WebUI process.

Attackers need valid credentials to reach the vulnerable code path, but Open WebUI deployments often grant function authoring rights to standard users. Once executed, the injected commands run with full filesystem and network access available to the service account, enabling credential theft, lateral movement, and tampering with AI model artifacts.

Root Cause

The root cause is missing input validation on requirement strings consumed by install_frontmatter_requirements. The function builds an OS command from attacker-controlled data and executes it through a shell, satisfying the conditions for [CWE-78] OS Command Injection. PIP requirement parsing alone does not sanitize shell metacharacters, so untrusted frontmatter content reaches the shell verbatim.

Attack Vector

The attack vector is network-based and requires authentication. An attacker submits a function, tool, or pipeline whose frontmatter requirements field contains crafted shell payloads. When Open WebUI processes the frontmatter and invokes the install routine, the injected payload executes on the host. No user interaction beyond the attacker's own authenticated request is required. Technical specifics are documented in the Zero Day Initiative Advisory ZDI-26-031.

Detection Methods for CVE-2026-0765

Indicators of Compromise

• Unexpected child processes of the Open WebUI Python process, such as sh, bash, curl, wget, or python spawning outside normal PIP install workflows.
• PIP install invocations containing shell metacharacters (;, &&, |, backticks, $()) in the requirement arguments.
• New outbound connections from the Open WebUI host to attacker-controlled infrastructure shortly after function or pipeline uploads.
• Newly created functions or pipelines whose frontmatter requirements fields contain non-package syntax.

Detection Strategies

• Audit Open WebUI application logs for calls to install_frontmatter_requirements and correlate them with the submitting user and supplied requirement strings.
• Monitor process lineage to flag shells or interpreters launched as descendants of the Open WebUI service, which deviates from baseline behavior.
• Inspect stored functions, tools, and pipelines for anomalous characters in dependency declarations and quarantine suspicious entries.

Monitoring Recommendations

• Forward Open WebUI host telemetry, including process execution and network connections, to a centralized analytics platform for behavioral review.
• Alert on PIP executions that include shell operators or that resolve packages from unexpected indexes.
• Track authentication events for accounts with function authoring privileges and review additions of new privileged users.

How to Mitigate CVE-2026-0765

Immediate Actions Required

• Upgrade Open WebUI to a fixed release published after version 0.6.32 as soon as the vendor makes one available.
• Restrict function, tool, and pipeline authoring permissions to a minimal set of trusted administrators.
• Rotate credentials, API keys, and tokens accessible to the Open WebUI service account if exploitation is suspected.
• Place Open WebUI behind authenticated reverse proxies and network controls that limit exposure to trusted users.

Patch Information

Review the Zero Day Initiative Advisory ZDI-26-031 for the latest remediation guidance from Open WebUI maintainers. Apply the vendor-supplied update that validates and sanitizes frontmatter requirement strings before passing them to PIP. Until a fix is installed, treat Open WebUI version 0.6.32 as vulnerable.

Workarounds

• Disable user-authored functions, tools, and pipelines that trigger install_frontmatter_requirements until a patch is applied.
• Run Open WebUI as a low-privilege, non-root user inside a hardened container with read-only filesystem mounts where feasible.
• Apply egress filtering to prevent the Open WebUI host from initiating outbound connections to arbitrary internet destinations.
• Enforce strong authentication and multi-factor verification for any account permitted to upload functions or pipelines.

# Configuration example: run Open WebUI as a constrained, non-root user with egress restrictions
docker run -d \
  --name open-webui \
  --user 10001:10001 \
  --read-only \
  --cap-drop=ALL \
  --security-opt no-new-privileges \
  --network openwebui-restricted \
  -p 127.0.0.1:8080:8080 \
  ghcr.io/open-webui/open-webui:latest