PT-2026-41192 · Unknown · Open-Webui

CVE-2026-45397 · Published 2026-05-10 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.5

Description An information disclosure issue exists where the 'GET /api/v1/retrieval/' endpoint returns live RAG (Retrieval-Augmented Generation) pipeline configuration to any unauthenticated HTTP client. No Authorization header, cookie, or API key is required to access this data. The issue is located in the get status() function within the backend/open webui/routers/retrieval.py component. This allows an attacker to obtain sensitive infrastructure details, including the RAG EMBEDDING ENGINE, RAG EMBEDDING MODEL, RAG RERANKING MODEL, RAG TEMPLATE, CHUNK SIZE, and CHUNK OVERLAP.

Recommendations Update to version 0.9.5.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2026-07224

CVE-2026-45397

GHSA-65PG-QHHW-MXWG

PYSEC-2026-2706

Affected Products

Open-Webui

References · 14

• 🔥 https://github.com/open-webui/open-webui/security/advisories/GHSA-65pg-qhhw-mxwg · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45397.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45397 · Security Note
• https://osv.dev/vulnerability/GHSA-65pg-qhhw-mxwg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-45397 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07224 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2706 · Vendor Advisory
• https://github.com/open-webui/open-webui/releases/tag/v0.9.5 · Note
• https://github.com/open-webui/open-webui · Note
• https://t.me/cveNotify/164002 · Telegram Post
• https://github.com/advisories/GHSA-65pg-qhhw-mxwg · Note
• https://t.me/CVEtracker/53960 · Telegram Post
• https://twitter.com/CVEnew/status/2055457520584437883 · Twitter Post
• https://pypi.org/project/open-webui · Note