PT-2026-41192 · Unknown · Open-Webui

Published 2026-05-10 · Updated 2026-05-19 · CVE-2026-45397

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.5

Description An information disclosure issue exists where the 'GET /api/v1/retrieval/' endpoint returns live RAG (Retrieval-Augmented Generation) pipeline configuration to any unauthenticated HTTP client. No Authorization header, cookie, or API key is required to access this data. The issue is located in the get status() function within the backend/open webui/routers/retrieval.py component. This allows an attacker to obtain sensitive infrastructure details, including the RAG EMBEDDING ENGINE, RAG EMBEDDING MODEL, RAG RERANKING MODEL, RAG TEMPLATE, CHUNK SIZE, and CHUNK OVERLAP.

Recommendations Update to version 0.9.5.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2026-07224

CVE-2026-45397

GHSA-65PG-QHHW-MXWG

Affected Products

Open-Webui

References · 9

• 🔥 https://github.com/open-webui/open-webui/security/advisories/GHSA-65pg-qhhw-mxwg · Exploit
• https://osv.dev/vulnerability/GHSA-65pg-qhhw-mxwg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45397 · Security Note
• https://bdu.fstec.ru/vul/2026-07224 · Security Note
• https://github.com/open-webui/open-webui · Note
• https://github.com/open-webui/open-webui/releases/tag/v0.9.5 · Note
• https://twitter.com/CVEnew/status/2055457520584437883 · Twitter Post
• https://t.me/cveNotify/164002 · Telegram Post
• https://t.me/CVEtracker/53960 · Telegram Post