PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45672 open-webui CVE debrief

Open WebUI versions prior to 0.8.12 contain a critical authorization bypass in the code execution feature. The /api/v1/utils/code/execute endpoint allows any authenticated user to execute arbitrary Python code via Jupyter, regardless of the ENABLE_CODE_EXECUTION=false configuration setting. The administrative feature gate is not enforced at the API layer, creating a dangerous gap between intended security policy and actual enforcement. This vulnerability enables authenticated attackers to achieve remote code execution with the privileges of the Open WebUI process, potentially leading to full system compromise, data exfiltration, or lateral movement within containerized or host environments. The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability with low attack complexity.

Vendor
open-webui
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-15
Original CVE updated
2026-05-19
Advisory published
2026-05-15
Advisory updated
2026-05-19

Who should care

Organizations running self-hosted Open WebUI instances with untrusted or partially-trusted user bases; security teams managing AI/ML infrastructure; DevOps engineers deploying Open WebUI in multi-tenant or production environments; compliance officers evaluating code execution controls in AI platforms

Technical summary

The vulnerability exists in the /api/v1/utils/code/execute API endpoint which interfaces with Jupyter for Python code execution. The ENABLE_CODE_EXECUTION configuration flag is intended to disable this functionality administratively, but the enforcement mechanism is absent from the API route handler. Authenticated users—regardless of role—can submit code execution requests that bypass the intended restriction. The code executes within the Jupyter environment with the privileges of the Open WebUI application process. This represents an authorization control failure (CWE-863) where security policy configuration is not synchronized with access control implementation. The fix in version 0.8.12 adds proper authorization checks to enforce the ENABLE_CODE_EXECUTION setting at the API layer.

Defensive priority

critical

Recommended defensive actions

  • Upgrade Open WebUI to version 0.8.12 or later immediately
  • Verify ENABLE_CODE_EXECUTION setting reflects intended security posture after upgrade
  • Audit access logs for unexpected /api/v1/utils/code/execute invocations prior to patching
  • Review and restrict authenticated user privileges to principle of least privilege
  • Implement network segmentation to limit Open WebUI process reachability
  • Monitor for anomalous Jupyter kernel processes or outbound connections from Open WebUI hosts

Evidence notes

Vendor advisory confirms the feature gate bypass and provides fixed version. NVD analysis confirms CWE-863 (Incorrect Authorization) classification and affected version range.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45672 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45672

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45672 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45672

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.