CVE-2026-44556: Open WebUI Auth Bypass Vulnerability

CVE-2026-44556 Overview

CVE-2026-44556 is a broken access control vulnerability [CWE-284] in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. Versions prior to 0.9.0 expose the /responses endpoint in the OpenAI router without enforcing per-model access control. Any authenticated user can interact with any configured model by sending a POST request to /api/openai/responses with an arbitrary model ID. The flaw bypasses the ownership, group membership, and AccessGrants checks enforced by the primary generate_chat_completion endpoint. The vendor patched the issue in Open WebUI version 0.9.0.

Critical Impact
Authenticated low-privilege users can invoke restricted LLM models, consuming upstream provider quotas and bypassing administrative model access policies.

Affected Products

Open WebUI versions prior to 0.9.0
Deployments exposing the /api/openai/responses proxy endpoint
Self-hosted Open WebUI instances with multi-user authentication enabled

Discovery Timeline

2026-05-15 - CVE-2026-44556 published to NVD
2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-44556

Vulnerability Analysis

The vulnerability resides in the OpenAI router component of Open WebUI. The application exposes two paths for interacting with upstream large language model (LLM) providers. The primary generate_chat_completion endpoint validates model ownership, group membership, and AccessGrants before forwarding requests. The /responses proxy endpoint only invokes get_verified_user to confirm an active session.

This inconsistency allows any authenticated user to pass an arbitrary model identifier in the request body. The router forwards the request to the upstream provider without consulting the access control layer. Restricted models intended for specific users or groups become reachable through the unprotected path.

The attack vector is network-based and requires only low-privilege authenticated access. No user interaction is needed. Exploitation impacts upstream provider quotas, billing, and the confidentiality of model configurations that administrators expected to gate behind permissions.

Root Cause

The root cause is missing authorization logic in the /responses proxy handler. The endpoint validates authentication but skips the per-model authorization checks present in the parallel chat completion path. This is a classic broken access control flaw stemming from inconsistent enforcement across functionally equivalent endpoints.

Attack Vector

An authenticated attacker sends a POST request to /api/openai/responses containing the model ID of any model configured on the target instance. The server forwards the request to the upstream LLM provider and returns the completion. The attacker does not need to be a member of any group associated with the model, nor hold an AccessGrant for it.

No verified proof-of-concept code is publicly available. See the GitHub Security Advisory GHSA-hp5m-24vp-vq2q for vendor-provided technical detail.

Detection Methods for CVE-2026-44556

Indicators of Compromise

POST requests to /api/openai/responses from user accounts that lack AccessGrants for the requested model ID
Unexpected upstream LLM provider usage spikes tied to non-privileged user sessions
Audit log entries showing model IDs in /responses payloads that do not match the caller's group membership

Detection Strategies

Compare model IDs in /api/openai/responses request bodies against the caller's authorized model list derived from AccessGrants
Alert when a single authenticated user invokes multiple distinct model IDs over short intervals through the /responses path
Correlate Open WebUI access logs with upstream provider billing telemetry to identify unauthorized model usage

Monitoring Recommendations

Enable verbose request logging on the OpenAI router and forward logs to a centralized SIEM for retention and analysis
Track per-user request counts and model diversity against historical baselines
Monitor authentication events and tie session identifiers to subsequent /responses calls for full request attribution

How to Mitigate CVE-2026-44556

Immediate Actions Required

Upgrade Open WebUI to version 0.9.0 or later, which enforces per-model authorization on the /responses endpoint
Audit existing access logs for prior requests to /api/openai/responses and identify any unauthorized model use
Rotate upstream LLM provider API keys if logs indicate exploitation or anomalous usage patterns

Patch Information

The vendor released a fix in Open WebUI 0.9.0. The patch adds the missing model ownership, group membership, and AccessGrants validation to the /responses handler. Refer to the Open WebUI GitHub Security Advisory for release notes and upgrade guidance.

Workarounds

Restrict network access to /api/openai/responses at a reverse proxy or web application firewall until the upgrade is applied
Disable the OpenAI router integration if it is not required for production workloads
Limit account creation and review existing low-privilege users to reduce the population of accounts able to reach the endpoint

bash

# Example: block the vulnerable endpoint at an Nginx reverse proxy
location = /api/openai/responses {
    return 403;
}