PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45387 open-webui CVE debrief

Open WebUI versions prior to 0.9.5 contain an information disclosure vulnerability where users granted read access to a model through group permissions can also view the model's system prompt. System prompts may contain confidential instructions, configuration details, or other sensitive content that model owners intend to keep private. The CVSS 3.1 score of 4.3 (Medium) reflects the network-accessible nature of the vulnerability with low attack complexity, though it requires authenticated access with low privileges. The issue was published on May 15, 2026, and the NVD record was last modified on May 19, 2026. The vendor has addressed this in version 0.9.5.

Vendor
open-webui
Product
Unknown
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-15
Original CVE updated
2026-05-19
Advisory published
2026-05-15
Advisory updated
2026-05-19

Who should care

Organizations running self-hosted Open WebUI instances with multi-user deployments, particularly those using system prompts containing proprietary business logic, safety configurations, or other confidential operational parameters. Administrators who have configured group-based model sharing should prioritize this update.

Technical summary

Open WebUI is a self-hosted AI platform. In versions before 0.9.5, the permission model does not adequately separate model usage rights from system prompt visibility. When a group is granted read access to a model for usage purposes, members of that group can also retrieve the model's system prompt through normal API interactions. System prompts often contain proprietary instructions, safety guidelines, or configuration parameters that operators consider confidential. The fix in 0.9.5 implements proper authorization checks to prevent unauthorized system prompt access while preserving intended model usage capabilities.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Open WebUI to version 0.9.5 or later to remediate this vulnerability
  • Review existing model permissions and group assignments to identify potentially exposed system prompts
  • Audit access logs for unauthorized system prompt access prior to patching
  • Consider implementing additional access controls for sensitive system prompts independent of model usage permissions
  • Monitor for future security advisories from the Open WebUI project

Evidence notes

The vulnerability is confirmed by the vendor security advisory (GHSA-h2cw-7qw9-56xr) and analyzed in the NVD. CPE criteria confirm affected versions are all releases prior to 0.9.5. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) is identified as the weakness type.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45387 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45387

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45387 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45387

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.