Open WebUI: Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection…
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- Record
- CVE-2026-44554
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 15, 2026
- Source last modified
- June 17, 2026
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the POST /api/v1/retrieval/process/web endpoint accepts a user-supplied collection_name and an overwrite query parameter (default: True). It performs no authorization check on whether the calling user owns or has write access to the target collection. When overwrite=True, save_docs_to_vector_db calls VECTOR_DB_CLIENT.delete_collection() on the target collection before writing new content. This vulnerability is fixed in 0.9.0.
Description quoted from the NVD record.
Who is affected
Open WebUI is a chat interface for using AI models, which organizations install and run on their own computers or servers. This flaw affects versions before 0.9.0. A part of the product that pulls content from a web page into a stored knowledge collection (the documents the AI draws on when answering) does not check whether the person using it owns or may change the target collection. A user with an account could delete another collection and replace it with content of their choosing, since replacing is the default behavior. This flaw is rated High.
What to do
- Find out who runs Open WebUI for your organization: the person who installed it, or an IT provider or vendor who manages it for you.
- If someone in your organization runs it, ask them to update Open WebUI to version
0.9.0or later, which fixes this flaw. - If an IT provider or vendor runs it for you, send them this advisory and ask when the update to
0.9.0or later will be done. - After the update, have the same person check that your stored knowledge collections still contain the documents you expect, since this flaw could have been used to delete or replace them.
Analysis written from the source record as of June 17, 2026 and reviewed before publishing.