Missing Authentication for Critical Function in Open WebUI - CVE-2026-45397
Published: May 11, 2026
Vulnerability identifier: #VU130949
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-45397
CWE-ID: CWE-306
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to missing authentication in get_status() in backend/open_webui/routers/retrieval.py when handling GET requests to /api/v1/retrieval/. A remote attacker can send an unauthenticated request to disclose sensitive information.
The endpoint returns live RAG pipeline configuration values including the RAG template, embedding model, embedding engine, reranking model, and chunking parameters.
Affected software
Open WebUI
How to mitigate CVE-2026-45397
Install security update from vendor's website.
Open WebUI - update to 0.9.5