CVE-2026-45672: Open WebUI arbitrary code execution via feature gate bypass

Executive brief

Open WebUI is an interface for interacting with large language models. A security flaw allows any logged-in user to execute arbitrary Python code on the server, even if an administrator has explicitly disabled the code execution feature. This could allow an attacker to access sensitive internal data, compromise the server, or use it as a jumping-off point to attack other internal systems.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in Open WebUI where the `/api/v1/utils/code/execute` endpoint fails to verify the `ENABLE_CODE_EXECUTION` configuration setting. An authenticated user can bypass the administrative 'disabled' state by sending a direct POST request to the execution router. This allows for arbitrary Python code execution within the Jupyter container, which can be leveraged for local file inclusion, process spawning, and Server-Side Request Forgery (SSRF) against internal network services. The issue was resolved in version 0.8.12 by adding a configuration check in the backend router.

Affected products

• Open WebUI Open WebUI <= 0.8.11

Timeline

• 2026-03-25: other: Vulnerability verified by researcher
• 2026-05-11: patched: Fix released in version 0.8.12
• 2026-05-14: advisory

References

• https://api.github.com/users/aliceQWAS
• https://github.com/aliceQWAS
• https://api.github.com/users/aliceQWAS/gists%7B/gist_id%7D
• https://api.github.com/users/aliceQWAS/repos
• https://avatars.githubusercontent.com/u/268486471?v=4
• https://api.github.com/users/aliceQWAS/events%7B/privacy%7D