Executive brief
Open WebUI, a popular interface for large language models, contains a publicly accessible endpoint that can be triggered without a password. An attacker can use this to force the system to perform complex mathematical calculations (embeddings) repeatedly. This can lead to significant financial costs if the system is connected to paid AI providers like OpenAI or Azure, and can also cause the service to become slow or unavailable for legitimate users.
Technical details
A missing authorization check (CWE-862) in the `/api/v1/memories/ef` endpoint allows unauthenticated users to trigger the `EMBEDDING_FUNCTION`. This endpoint was originally intended for debugging and hard-codes the input string "hello world". By repeatedly calling this GET request, a network-based attacker can exhaust server CPU/GPU resources or deplete credits/rate-limits on configured third-party embedding providers (e.g., OpenAI, Azure). The vulnerability was resolved in version 0.8.0 by removing the diagnostic endpoint entirely.
Affected products
- Open WebUI Open WebUI <= 0.7.2
Timeline
- 2026-02-01: patched: First released in v0.8.0
- 2026-05-11: disclosed: Advisory published on GitHub
- 2026-05-14: advisory: GitHub Advisory reviewed and published to database