CVE-2026-87017: Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.1, the built-in knowledge search tool passed the caller's readable knowledge identifiers through a metadata filter, but the search methods in eleven shipped vector backends ignored that filter. An authenticated user on an affected backend could enumerate the identifiers, names, and descriptions of inaccessible knowledge bases from the shared collection, although the associated document text remained in separate collections. This issue is fixed in version 0.11.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Open WebUIto a version that resolves this vulnerability.Fixed in 0.11.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running Open WebUI versions from 0.7.0 through 0.11.1 are affected when using one of the eleven shipped vector backends whose search method ignored the metadata filter. The issue is reachable by authenticated users through the built-in knowledge search tool.
What can an attacker access?
An authenticated user can enumerate identifiers, names, and descriptions for knowledge bases that should be inaccessible to them. The associated document text is not exposed because it remains in separate collections.
What level of access is required to exploit this?
The attacker needs an authenticated Open WebUI account. No user interaction is required, and exploitation can be performed over the network through the built-in knowledge tool.
What is the remediation?
Upgrade to Open WebUI version 0.11.1, which fixes the issue.