CVE-2026-87017: Open WebUI Information Disclosure Vulnerability

CVE-2026-87017 Overview

CVE-2026-87017 is an information disclosure vulnerability in Open WebUI, a self-hosted AI platform. The flaw affects versions from 0.7.0 through 0.11.0. The built-in knowledge search tool passes the caller's readable knowledge identifiers through a metadata filter. However, the search methods in eleven shipped vector backends ignore that filter. An authenticated user can enumerate identifiers, names, and descriptions of knowledge bases they should not access. The underlying document text remains isolated in separate collections and is not exposed. The vendor released a fix in version 0.11.1.

Critical Impact
Authenticated users on affected vector backends can enumerate metadata of inaccessible knowledge bases from a shared collection, leaking identifiers, names, and descriptions [CWE-200].

Affected Products

Open WebUI versions 0.7.0 through 0.11.0
Deployments using any of the eleven shipped vector database backends (including Elasticsearch and Milvus)
Multi-tenant Open WebUI instances with shared vector collections

Discovery Timeline

2026-09-09 - CVE-2026-87017 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87017

Vulnerability Analysis

Open WebUI's knowledge search tool implements authorization by attaching the caller's readable knowledge identifiers to a metadata filter. This filter is then passed to the underlying vector store during search operations. The search methods across eleven shipped vector backends did not honor the metadata filter parameter. As a result, queries returned matches from knowledge bases the user was never granted access to view.

The exposed data is limited to metadata records stored in the shared collection. These records include the knowledge base identifier, human-readable name, and description. The document body text is stored in separate per-knowledge-base collections and is not returned by the vulnerable search path. This scoping keeps the impact confined to confidentiality of knowledge base catalog metadata rather than the underlying documents.

Root Cause

The root cause is an inconsistency between the authorization layer and the retrieval layer. The higher-level tool constructs a metadata filter expressing which identifiers the caller may see, but individual backend implementations in backend/open_webui/retrieval/vector/dbs/ do not apply the filter inside their search methods. This is an information exposure defect classified under [CWE-200].

Attack Vector

Exploitation requires an authenticated Open WebUI account with permission to invoke the knowledge search tool. The attacker submits normal search queries and receives result metadata that includes entries belonging to knowledge bases outside their access scope. No special crafting of the request is required beyond issuing valid searches.

python

# Patch excerpt: backend/open_webui/retrieval/vector/dbs/elasticsearch.py
 """
 
 import ssl
-from typing import Optional
+from typing import Any, Optional
 
 from elasticsearch import BadRequestError, Elasticsearch
 from elasticsearch.helpers import bulk, scan

# Patch excerpt: backend/open_webui/retrieval/vector/dbs/milvus.py
 """
 
 import logging
-from typing import Optional
+import re
+from typing import Any, Optional
 
 from open_webui.config import (
     MILVUS_DB,

Source: GitHub Commit 1d6d4e6. The commit introduces Any typing (and regex support in Milvus) to accept and apply structured metadata filters inside each backend's search implementation.

Detection Methods for CVE-2026-87017

Indicators of Compromise

Authenticated user sessions issuing repeated knowledge search queries that return result sets referencing knowledge base identifiers outside the user's assigned scope.
Application logs showing knowledge base metadata (id, name, description) served to accounts that lack membership in those knowledge bases.
Unusual enumeration patterns such as broad or wildcard search terms from a single account within a short time window.

Detection Strategies

Correlate Open WebUI access logs with the knowledge base access control list to identify search responses containing identifiers the caller does not own.
Track the running version of Open WebUI across deployments and flag any instance in the 0.7.0 through 0.11.0 range as vulnerable.
Review reverse-proxy or application logs for spikes in /api/v1/knowledge or search endpoint traffic from individual users.

Monitoring Recommendations

Forward Open WebUI application and audit logs to a centralized log store for retention and query.
Alert on any authenticated user retrieving more distinct knowledge base identifiers than their group membership permits.
Baseline normal search volumes per user and alert on statistical outliers.

How to Mitigate CVE-2026-87017

Immediate Actions Required

Upgrade all Open WebUI instances to version 0.11.1 or later, which fixes the metadata filter enforcement in every shipped vector backend.
Inventory user accounts with access to the knowledge search tool and review recent activity for signs of enumeration.
Rotate or rename knowledge base descriptions that contain sensitive terminology if exposure to unauthorized internal users is a concern.

Patch Information

The fix is included in Open WebUI v0.11.1 and delivered via commit 1d6d4e6. Details are documented in GHSA-pcvc-8vrv-8q6w. The patch updates each backend's search method under backend/open_webui/retrieval/vector/dbs/ to accept and enforce the metadata filter passed by the caller.

Workarounds

Restrict access to the knowledge search tool to trusted user groups until the upgrade to 0.11.1 is completed.
Segregate sensitive knowledge bases into isolated Open WebUI deployments that do not share tenants with lower-trust users.
Avoid placing confidential information in knowledge base names or descriptions, since these fields are what the vulnerability exposes.

bash

# Upgrade Open WebUI to the patched release
docker pull ghcr.io/open-webui/open-webui:v0.11.1
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:v0.11.1

# Verify the running version
docker exec open-webui cat /app/backend/open_webui/env.py | grep VERSION