Securaity Browse advisories
SA-26-077 High

Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false`, feature gate bypassed

Open WebUI

More for Open WebUI RSS feed for Open WebUI

Severity
High, CVSS 8.8
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Record
CVE-2026-45672
Affects
Open WebUI
Known exploited
Not listed in the CISA Known Exploited Vulnerabilities catalog
Published
Record first published by the source
May 15, 2026
Source last modified
June 17, 2026

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.12, the /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes. This vulnerability is fixed in 0.8.12.

Description quoted from the NVD record.

Who is affected

Open WebUI is a chat interface your organization can run on its own computers to talk with AI models, even without an internet connection. This flaw affects versions before 0.8.12. In those versions, any user with a confirmed account can make the system run any Python program they choose through its built-in code running feature (Jupyter), even when an administrator has switched code running off. The setting says the feature is disabled, but code still runs. This flaw is rated High.

What to do

  1. The person who installed or runs Open WebUI for your organization should handle this. If an IT provider or vendor manages it for you, send them this advisory and ask when the update will be done.
  2. Update Open WebUI to version 0.8.12 or later, which fixes this flaw.
  3. Until the update is done, keep in mind that turning off code running in the admin settings does not stop this problem, so do not rely on that setting for protection.
  4. After updating, check that Open WebUI shows version 0.8.12 or later.

Analysis written from the source record as of June 17, 2026 and reviewed before publishing.

Sources

MORE ADVISORIES

See all