CVE-2026-44554: Open WebUI Auth Bypass Vulnerability

CVE-2026-44554 Overview

CVE-2026-44554 is a missing authorization vulnerability [CWE-862] in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. Versions prior to 0.9.0 expose the POST /api/v1/retrieval/process/web endpoint without verifying whether the authenticated user owns or has write access to the target collection. An attacker supplies a collection_name parameter alongside the default overwrite=True query parameter to overwrite arbitrary vector collections belonging to other users. Open WebUI version 0.9.0 resolves the issue.

Critical Impact
Authenticated low-privilege users can destroy and overwrite any vector database collection on the instance, corrupting retrieval-augmented generation (RAG) data and causing denial of service for other tenants.

Affected Products

Open WebUI versions prior to 0.9.0
Self-hosted Open WebUI deployments exposing the retrieval API
Multi-user Open WebUI instances sharing vector database backends

Discovery Timeline

2026-05-15 - CVE-2026-44554 published to NVD
2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-44554

Vulnerability Analysis

The vulnerability resides in the POST /api/v1/retrieval/process/web endpoint of Open WebUI. The handler accepts a user-supplied collection_name parameter and an overwrite query parameter that defaults to True. The endpoint performs no authorization check confirming that the calling user owns or has write access to the target collection.

When overwrite=True, the internal save_docs_to_vector_db function invokes VECTOR_DB_CLIENT.delete_collection() against the specified collection before writing new content. Any authenticated user can therefore delete and replace vector collections belonging to other users or administrators.

Root Cause

The root cause is missing authorization [CWE-862] on a sensitive write operation. The endpoint trusts the collection_name value from the request without resolving it against the caller's ownership or role. Combined with the destructive default behavior of overwrite=True, the absence of access control allows cross-tenant data tampering.

Attack Vector

Exploitation requires network access to the Open WebUI API and a valid low-privilege account. The attacker issues a single authenticated HTTP POST request to /api/v1/retrieval/process/web specifying the victim's collection_name and a URL to scrape. The server deletes the targeted collection and ingests attacker-controlled content in its place, enabling both destruction and poisoning of retrieval data used by downstream language models.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-7r82-qhg4-6wvj for vendor technical details.

Detection Methods for CVE-2026-44554

Indicators of Compromise

HTTP POST requests to /api/v1/retrieval/process/web containing a collection_name value not associated with the authenticated user.
Unexpected delete_collection events in vector database logs (Chroma, Milvus, Qdrant, or pgvector) followed by ingestion from unfamiliar source URLs.
Sudden disappearance or replacement of RAG knowledge bases reported by legitimate users.

Detection Strategies

Audit Open WebUI access logs for /api/v1/retrieval/process/web calls and correlate the collection_name field against the authenticated user's owned collections.
Alert on any request to this endpoint where overwrite is True and the caller is not the collection owner or an administrator.
Baseline normal RAG ingestion patterns and flag spikes in collection deletions or rewrites.

Monitoring Recommendations

Forward Open WebUI application logs and reverse-proxy access logs to a centralized logging platform for retention and search.
Enable vector database audit logging where supported and monitor delete_collection operations.
Track Open WebUI version strings across deployments to identify instances still running releases prior to 0.9.0.

How to Mitigate CVE-2026-44554

Immediate Actions Required

Upgrade all Open WebUI instances to version 0.9.0 or later without delay.
Inventory user accounts and rotate API keys for any account suspected of being abused.
Restore impacted vector collections from backup and validate RAG content integrity before re-enabling user-facing features.

Patch Information

The vulnerability is fixed in Open WebUI 0.9.0. Refer to the Open WebUI GHSA-7r82-qhg4-6wvj advisory for vendor remediation guidance and release notes.

Workarounds

Restrict network access to Open WebUI behind an authenticated reverse proxy and limit retrieval endpoints to trusted administrators until patching is complete.
Disable or block the /api/v1/retrieval/process/web route at the reverse proxy layer if upgrading immediately is not feasible.
Reduce account privileges and disable open user registration to limit the population of accounts that can reach the vulnerable endpoint.

bash

# Example NGINX rule blocking the vulnerable endpoint until patched
location /api/v1/retrieval/process/web {
    return 403;
}