CVE-2026-45399: Open WebUI Auth Bypass Vulnerability

CVE-2026-45399 Overview

CVE-2026-45399 is a missing authorization vulnerability [CWE-862] in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. Versions prior to 0.9.0 allow any authenticated low-privileged user to enumerate active background tasks across the system and stop tasks owned by other users. The flaw resides in the GET /api/tasks and POST /api/tasks/stop/{task_id} endpoints, which fail to enforce ownership checks. An attacker can repeatedly cancel other users' active tasks, disrupting chat usage in multi-user deployments. The vulnerability is fixed in Open WebUI 0.9.0.

Critical Impact
A low-privileged authenticated user can disrupt system-wide AI chat operations by continuously cancelling other users' active background tasks across a shared Open WebUI deployment.

Affected Products

Open WebUI versions prior to 0.9.0
Multi-user Open WebUI deployments exposing the /api/tasks endpoints
Self-hosted AI platforms running affected Open WebUI builds

Discovery Timeline

2026-05-15 - CVE-2026-45399 published to NVD
2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-45399

Vulnerability Analysis

The vulnerability is a broken access control issue in Open WebUI's task management API. The application exposes two endpoints, GET /api/tasks and POST /api/tasks/stop/{task_id}, which return and manipulate background task state. Both endpoints authenticate the caller but do not verify whether the caller owns the referenced task. As a result, any authenticated account can enumerate every active task identifier in the system and terminate tasks belonging to other users.

In a multi-user deployment, this breaks the integrity and availability of conversations. An attacker scripts a loop that lists task IDs and immediately stops each one, cancelling in-progress LLM completions, embeddings, and Retrieval-Augmented Generation (RAG) jobs for every other user. The flaw does not require elevated privileges or user interaction.

Root Cause

The root cause is missing authorization logic [CWE-862] on task-scoped operations. The endpoint handlers treat the authenticated session as sufficient to act on any task_id, omitting the ownership check that should bind a task record to the user that created it. Authentication is enforced, but authorization is not.

Attack Vector

Exploitation requires network access to the Open WebUI instance and a valid low-privilege account, which any registered user possesses. The attacker calls GET /api/tasks to enumerate task identifiers belonging to other users, then issues POST /api/tasks/stop/{task_id} for each one. Running this in a loop produces a persistent denial-of-service condition against legitimate users without triggering privilege-related anomaly signals. No verified public exploit code is available; see the GitHub Security Advisory GHSA-8jjp-r2w2-4v22 for vendor details.

Detection Methods for CVE-2026-45399

Indicators of Compromise

Repeated POST /api/tasks/stop/{task_id} requests from a single user session targeting many distinct task_id values.
High-volume GET /api/tasks polling from a single account followed by stop requests within seconds.
User complaints about AI chat completions, embeddings, or RAG jobs terminating without user action.

Detection Strategies

Correlate the user_id on the authenticated session with the owner of each task_id referenced in stop requests and alert on mismatches.
Baseline normal /api/tasks request volumes per user and alert when a single account exceeds the baseline.
Review reverse proxy or application logs for sequential task_id enumeration patterns against /api/tasks/stop/.

Monitoring Recommendations

Forward Open WebUI application logs and reverse proxy access logs to a centralized logging or SIEM platform.
Add a detection rule that flags any account stopping more than a threshold of tasks per minute.
Track abrupt drops in completed task counts across the deployment as a secondary availability signal.

How to Mitigate CVE-2026-45399

Immediate Actions Required

Upgrade Open WebUI to version 0.9.0 or later, which enforces ownership checks on task endpoints.
Audit user accounts and remove unused or untrusted accounts that can authenticate to the platform.
Review recent task cancellation activity to confirm no abuse occurred prior to patching.

Patch Information

The vendor has released Open WebUI 0.9.0, which fixes the authorization gap on GET /api/tasks and POST /api/tasks/stop/{task_id}. Refer to the Open WebUI GitHub Security Advisory GHSA-8jjp-r2w2-4v22 for the official fix details and upgrade guidance.

Workarounds

Restrict Open WebUI registration and limit accounts to trusted users until the upgrade is applied.
Place a reverse proxy in front of Open WebUI and rate-limit requests to /api/tasks and /api/tasks/stop/ per authenticated user.
Temporarily block external access to the task endpoints via web server rules where operational requirements allow.

bash

# Example nginx rate limit for task endpoints as a temporary workaround
limit_req_zone $http_authorization zone=owui_tasks:10m rate=10r/m;

location ~ ^/api/tasks(/stop/.*)?$ {
    limit_req zone=owui_tasks burst=5 nodelay;
    proxy_pass http://open_webui_backend;
}