TI-2026-33135 Aliases CVE-2026-45339 GHSA-57q6-fvp4-pqmm

Incorrect authorization in open-webui

MEDIUM 64CWE-863Published 2026-05-15 · Updated 2026-05-19

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, Open WebUI allows admins to restrict which API endpoints an API key can access. When an API key is restricted from /api/v1/messages, requests using the Authorization: Bearer sk-... header are correctly blocked with 403. However, the same key sent via the x-api-key header bypasses the restriction entirely — the request is authenticated, the model is invoked, and a full response is returned. This vulnerability is fixed in 0.9.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00309 23rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed open-webui (open-webui): 0.9.0open-webui (PyPI): 0.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
open-webui	open-webui	before 0.9.0	0.9.0	Patch available	CNA
—	open-webui (PyPI)	before 0.9.0	0.9.0	Patch available	GHSA-57q6-fvp4-pqmm

open-webui Vendoropen-webui Affected before 0.9.0 Fixed in 0.9.0 Patch available CNA
open-webui (PyPI) Vendor— Affected before 0.9.0 Fixed in 0.9.0 Patch available GHSA-57q6-fvp4-pqmm

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openwebui:open_webui::::::::	before 0.9.0	Vulnerable	open-webui

cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* Versions before 0.9.0 Vulnerable ·open-webui

Remediation

Fix · CNA open-webui (open-webui) Fixed in 0.9.0
Fix · GHSA-57q6-fvp4-pqmm open-webui (PyPI) Fixed in 0.9.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-45339
2026-10-03 Alias added: GHSA-57q6-fvp4-pqmm
2026-11-03 Fix available: PyPI/[email protected] · GHSA-57q6-fvp4-pqmm
2026-11-03 3 new references · GHSA-57q6-fvp4-pqmm

References

Exploit 1

https://github.com/open-webui/open-webui/security/advisories/GHSA-57q6-fvp4-pqmm

Advisory 2

Other 4

TI-2024-06216 Open WebUI Arbitrary File Upload + Path Traversal CVSS 3.1HIGH 8.8
TI-2024-07467 Improper Authentication in open-webui/open-webui CVSS 3.1HIGH 8.2
TI-2026-42359 Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id CVSS 3.1CRITICAL 9.0
TI-2026-40759 open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation CVSS 4.0CRITICAL 9.0
TI-2024-07431 Cross-site Scripting (XSS) in open-webui/open-webui CVSS 3.0CRITICAL 9.0
TI-2026-60021 Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin CVSS 3.1HIGH 8.7

See all 154 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences