GHSA-65PG-QHHW-MXWG

Vulnerability from github – Published: 2026-05-14 20:26 – Updated: 2026-05-15 23:55
VLAI
Summary
Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure
Details

Vulnerability Type: Information Disclosure / Missing Authentication
Severity: Medium
Component: backend/open_webui/routers/retrieval.py — get_status() (GET /)
Affected Endpoint: GET /api/v1/retrieval/
Affected Version: Open WebUI main branch — confirmed unpatched through v0.9.2
Authentication Required: None — internet-facing with zero credentials
CVSSv3.1 Score: 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Summary

GET /api/v1/retrieval/ returns live RAG pipeline configuration to any unauthenticated HTTP client. No Authorization header, cookie, or API key is required. Every adjacent endpoint on the same router (/embedding, /config) is correctly guarded by get_admin_user making this a targeted omission.

Root Cause

backend/open_webui/routers/retrieval.py:262

@router.get('/')
async def get_status(request: Request):   # ← no Depends(get_verified_user)
    return {
        'status': True,
        'CHUNK_SIZE': request.app.state.config.CHUNK_SIZE,
        'CHUNK_OVERLAP': request.app.state.config.CHUNK_OVERLAP,
        'RAG_TEMPLATE': request.app.state.config.RAG_TEMPLATE,
        'RAG_EMBEDDING_ENGINE': request.app.state.config.RAG_EMBEDDING_ENGINE,
        'RAG_EMBEDDING_MODEL': request.app.state.config.RAG_EMBEDDING_MODEL,
        'RAG_RERANKING_MODEL': request.app.state.config.RAG_RERANKING_MODEL,
        'RAG_EMBEDDING_BATCH_SIZE': request.app.state.config.RAG_EMBEDDING_BATCH_SIZE,
        'ENABLE_ASYNC_EMBEDDING': request.app.state.config.ENABLE_ASYNC_EMBEDDING,
        'RAG_EMBEDDING_CONCURRENT_REQUESTS': request.app.state.config.RAG_EMBEDDING_CONCURRENT_REQUESTS,
    }

Compare with every adjacent endpoint on the same router:

@router.get('/embedding')
async def get_embedding_config(request: Request, user=Depends(get_admin_user)):  # ✅

@router.get('/config')
async def get_rag_config(request: Request, user=Depends(get_admin_user)):        # ✅

Proof Of Concept — No Token Required

curl -s http://TARGET/api/v1/retrieval/

{
  "status": true,
  "CHUNK_SIZE": 1000,
  "CHUNK_OVERLAP": 100,
  "RAG_TEMPLATE": "### Task:\nRespond to the user query using the provided context...\n<context>\n{{CONTEXT}}\n</context>",
  "RAG_EMBEDDING_ENGINE": "",
  "RAG_EMBEDDING_MODEL": "sentence-transformers/all-MiniLM-L6-v2",
  "RAG_RERANKING_MODEL": "",
  "RAG_EMBEDDING_BATCH_SIZE": 1,
  "ENABLE_ASYNC_EMBEDDING": true,
  "RAG_EMBEDDING_CONCURRENT_REQUESTS": 0
}

Disclosed Information and Its Value to an Attacker

Field What it reveals
RAG_EMBEDDING_ENGINE Backend type (OpenAI, Ollama, Azure, etc.)
RAG_EMBEDDING_MODEL Exact model name — reveals embedding model
RAG_RERANKING_MODEL Reranker in use — reveals reranker
RAG_TEMPLATE RAG template — exposes the RAG template
CHUNK_SIZE / CHUNK_OVERLAP Chunking parameters — enables exact reconstruction of how documents are split and retrieved

Attack Scenario

  1. Attacker sends one unauthenticated HTTP GET to /api/v1/retrieval/.
  2. Response reveals the embedding model and chunking parameters.
  3. Attacker uses the exact chunk size/overlap to craft RAG poisoning payloads that are guaranteed to be retrieved.

Impact

  1. RAG template disclosure
  2. Infrastructure fingerprinting — embedding engine and model name reveal the AI stack to an internet scanner
  3. RAG attack surface mapping — chunk parameters enable precise calculation of retrieval boundaries
  4. Zero-effort recon — no brute force, no credentials, no rate-limit concern. Single request from any IP.

Recommended Fix

Add get_verified_user dependency (or get_admin_user for stricter control):

# BEFORE (vulnerable)
@router.get('/')
async def get_status(request: Request):


# AFTER
@router.get('/')
async def get_status(request: Request, user=Depends(get_verified_user)):
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45397"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-14T20:26:34Z",
    "nvd_published_at": "2026-05-15T21:16:37Z",
    "severity": "MODERATE"
  },
  "details": "**Vulnerability Type:** Information Disclosure / Missing Authentication  \n**Severity:** Medium  \n**Component:** `backend/open_webui/routers/retrieval.py` \u2014 `get_status()` (`GET /`)  \n**Affected Endpoint:** `GET /api/v1/retrieval/`  \n**Affected Version:** Open WebUI `main` branch \u2014 confirmed unpatched through **v0.9.2**  \n**Authentication Required:** None \u2014 internet-facing with zero credentials  \n**CVSSv3.1 Score:** 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)\n\n---\n\n## Summary\n\n`GET /api/v1/retrieval/` returns live RAG pipeline configuration to any unauthenticated HTTP client. No `Authorization` header, cookie, or API key is required. Every adjacent endpoint on the same router (`/embedding`, `/config`) is correctly guarded by `get_admin_user` making this a targeted omission.\n\n---\n\n## Root Cause\n\n`backend/open_webui/routers/retrieval.py:262`\n\n```python\n@router.get(\u0027/\u0027)\nasync def get_status(request: Request):   # \u2190 no Depends(get_verified_user)\n    return {\n        \u0027status\u0027: True,\n        \u0027CHUNK_SIZE\u0027: request.app.state.config.CHUNK_SIZE,\n        \u0027CHUNK_OVERLAP\u0027: request.app.state.config.CHUNK_OVERLAP,\n        \u0027RAG_TEMPLATE\u0027: request.app.state.config.RAG_TEMPLATE,\n        \u0027RAG_EMBEDDING_ENGINE\u0027: request.app.state.config.RAG_EMBEDDING_ENGINE,\n        \u0027RAG_EMBEDDING_MODEL\u0027: request.app.state.config.RAG_EMBEDDING_MODEL,\n        \u0027RAG_RERANKING_MODEL\u0027: request.app.state.config.RAG_RERANKING_MODEL,\n        \u0027RAG_EMBEDDING_BATCH_SIZE\u0027: request.app.state.config.RAG_EMBEDDING_BATCH_SIZE,\n        \u0027ENABLE_ASYNC_EMBEDDING\u0027: request.app.state.config.ENABLE_ASYNC_EMBEDDING,\n        \u0027RAG_EMBEDDING_CONCURRENT_REQUESTS\u0027: request.app.state.config.RAG_EMBEDDING_CONCURRENT_REQUESTS,\n    }\n```\n\nCompare with every adjacent endpoint on the same router:\n\n```python\n@router.get(\u0027/embedding\u0027)\nasync def get_embedding_config(request: Request, user=Depends(get_admin_user)):  # \u2705\n\n@router.get(\u0027/config\u0027)\nasync def get_rag_config(request: Request, user=Depends(get_admin_user)):        # \u2705\n```\n\n---\n\n## Proof Of Concept \u2014 No Token Required\n\n```bash\ncurl -s http://TARGET/api/v1/retrieval/\n```\n\n```json\n{\n  \"status\": true,\n  \"CHUNK_SIZE\": 1000,\n  \"CHUNK_OVERLAP\": 100,\n  \"RAG_TEMPLATE\": \"### Task:\\nRespond to the user query using the provided context...\\n\u003ccontext\u003e\\n{{CONTEXT}}\\n\u003c/context\u003e\",\n  \"RAG_EMBEDDING_ENGINE\": \"\",\n  \"RAG_EMBEDDING_MODEL\": \"sentence-transformers/all-MiniLM-L6-v2\",\n  \"RAG_RERANKING_MODEL\": \"\",\n  \"RAG_EMBEDDING_BATCH_SIZE\": 1,\n  \"ENABLE_ASYNC_EMBEDDING\": true,\n  \"RAG_EMBEDDING_CONCURRENT_REQUESTS\": 0\n}\n```\n\n---\n\n## Disclosed Information and Its Value to an Attacker\n\n| Field | What it reveals |\n|---|---|\n| `RAG_EMBEDDING_ENGINE` | Backend type (OpenAI, Ollama, Azure, etc.) |\n| `RAG_EMBEDDING_MODEL` | Exact model name \u2014 reveals embedding model |\n| `RAG_RERANKING_MODEL` | Reranker in use \u2014 reveals reranker |\n| `RAG_TEMPLATE` | **RAG template** \u2014 exposes the RAG template |\n| `CHUNK_SIZE` / `CHUNK_OVERLAP` | Chunking parameters \u2014 enables exact reconstruction of how documents are split and retrieved |\n\n---\n\n## Attack Scenario\n\n1. Attacker sends one unauthenticated HTTP GET to `/api/v1/retrieval/`.\n2. Response reveals the embedding model and chunking parameters.\n3. Attacker uses the exact chunk size/overlap to craft RAG poisoning payloads that are guaranteed to be retrieved.\n\n---\n\n## Impact\n\n1. **RAG template disclosure**\n2. **Infrastructure fingerprinting** \u2014 embedding engine and model name reveal the AI stack to an internet scanner\n3. **RAG attack surface mapping** \u2014 chunk parameters enable precise calculation of retrieval boundaries\n4. **Zero-effort recon** \u2014 no brute force, no credentials, no rate-limit concern. Single request from any IP.\n\n---\n\n## Recommended Fix\n\nAdd `get_verified_user` dependency (or `get_admin_user` for stricter control):\n\n```python\n# BEFORE (vulnerable)\n@router.get(\u0027/\u0027)\nasync def get_status(request: Request):\n\n\n# AFTER\n@router.get(\u0027/\u0027)\nasync def get_status(request: Request, user=Depends(get_verified_user)):\n```",
  "id": "GHSA-65pg-qhhw-mxwg",
  "modified": "2026-05-15T23:55:19Z",
  "published": "2026-05-14T20:26:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-65pg-qhhw-mxwg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45397"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/releases/tag/v0.9.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.