CVE-2026-54009: Open WebUI Privilege Escalation Flaw

CVE-2026-54009 Overview

CVE-2026-54009 is an Insecure Direct Object Reference (IDOR) vulnerability in Open WebUI, a self-hosted artificial intelligence platform designed to run entirely offline. Versions prior to 0.9.6 mishandle the image_url.url parameter on the POST /api/chat/completions endpoint. When the value does not begin with http://, https://, or data:image/, the server treats it as a file identifier and resolves it against the global file table without performing an ownership check. An authenticated attacker can substitute another user's file ID, prompt the LLM to describe or OCR the attached content, and read back the file data. The issue is tracked under CWE-639 and fixed in version 0.9.6.

Critical Impact
Authenticated attackers can exfiltrate arbitrary files owned by other Open WebUI users by abusing the chat completions endpoint as a file-read primitive through the LLM.

Affected Products

Open WebUI versions prior to 0.9.6
Self-hosted deployments exposing /api/chat/completions
Multi-tenant Open WebUI instances with shared file storage

Discovery Timeline

2026-06-23 - CVE-2026-54009 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54009

Vulnerability Analysis

The vulnerability resides in the request handler for POST /api/chat/completions. The handler accepts a message content block containing an image_url object with a url field. The server inspects the prefix of that string to determine handling. Strings starting with http://, https://, or data:image/ are processed as remote URLs or inline base64 images. Any other value is interpreted as a local file identifier and resolved against the global file table.

The lookup performs no authorization check binding the file owner to the requesting user. The server reads the referenced file from disk, base64-encodes its contents, and embeds the resulting data URI into the upstream large language model (LLM) request. The attacker then instructs the model to describe or OCR the attachment, returning the decoded content in the chat response.

Root Cause

The root cause is missing ownership validation during file lookup ([CWE-639]). The file resolver trusts client-supplied identifiers without checking that the requesting user owns or has been granted access to the referenced file record.

Attack Vector

Exploitation requires only valid authenticated credentials on the target Open WebUI instance. The attacker sends a crafted chat completion request with image_url.url set to a target file ID. The LLM then acts as an oracle, returning textual representations of any file it can read, including documents, images, and configuration assets uploaded by other tenants. No user interaction by the victim is required.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-wch8-mhj5-9frg for vendor technical details.

Detection Methods for CVE-2026-54009

Indicators of Compromise

Requests to POST /api/chat/completions where image_url.url does not begin with http://, https://, or data:image/.
Chat completion payloads containing short opaque strings or UUID-like values in the image_url.url field.
Unexpected file read activity in Open WebUI storage paths originating from the application service account.
Spikes in OCR-style or document-description prompts following file ID enumeration attempts.

Detection Strategies

Inspect application logs for image_url.url values that resolve to internal file IDs rather than URLs or data URIs.
Correlate file table read events with the authenticated user ID to flag cross-user accesses.
Deploy reverse proxy or web application firewall rules that validate the URL scheme of image_url.url parameters.

Monitoring Recommendations

Enable verbose request logging for /api/chat/completions and ship logs to a centralized analytics platform.
Alert on authenticated users requesting many distinct file IDs within short time windows, indicating enumeration.
Audit file access events against the file owner field to detect unauthorized cross-tenant reads.

How to Mitigate CVE-2026-54009

Immediate Actions Required

Upgrade Open WebUI to version 0.9.6 or later on all instances.
Rotate any secrets, API keys, or credentials that may have been stored in user-uploaded files.
Review file access logs since deployment for anomalous cross-user file lookups.
Restrict network exposure of Open WebUI to trusted users until patching is complete.

Patch Information

The vulnerability is fixed in Open WebUI 0.9.6. The vendor advisory is published as GHSA-wch8-mhj5-9frg. Administrators should upgrade containers or Python packages to the patched release and restart the service.

Workarounds

Place Open WebUI behind a reverse proxy that rejects image_url.url values not starting with http://, https://, or data:image/.
Disable file upload features for untrusted users until the upgrade is applied.
Segment multi-tenant deployments so that each user group runs an isolated Open WebUI instance with separate storage.

bash

# Upgrade Open WebUI to the patched release
pip install --upgrade open-webui==0.9.6

# Or for container deployments
docker pull ghcr.io/open-webui/open-webui:0.9.6
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.9.6