# CVE-2026-87017: Open WebUI knowledge tool authorization bypass

Source: https://junglewise.ai/threats/cve-2026-87017-open-webui-knowledge-tool-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-87017 · Severity: medium · CVSS 4.3 · Published 2026-09-09

Open WebUI's built-in knowledge search tool exposes metadata from knowledge bases that users should not have access to. When using most external vector databases (such as Qdrant, Elasticsearch, OpenSearch, or Milvus) instead of the default Chroma backend, the application fails to enforce access controls on knowledge base searches, allowing any authenticated user to discover and enumerate sensitive knowledge base names and descriptions that were never shared with them. This affects deployments that have deliberately switched to external vector stores, typically larger installations.

Technologies: [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-87017 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87017 being exploited in the wild.

**How severe is CVE-2026-87017?** Medium severity, with a CVSS score of 4.3, published 9 September 2026.

**Which products and versions are affected?** open-webui (PyPI) >= 0.7.0, <= 0.11.0, ECOSYSTEM:introduced=0.7.0,fixed=0.11.1.

**Is there a fix for CVE-2026-87017?** Yes. open-webui (PyPI): upgrade to 0.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-87017 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-87017?** Check whether you run open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- open-webui (PyPI): upgrade to 0.11.1 or later

  ```sh
  pip install "open-webui>=0.11.1"
  ```


## Technical details

The vulnerability is an incorrect authorization (CWE-863) and sensitive information exposure (CWE-200) in the knowledge base search functionality. The built-in knowledge search tool constructs a filter of authorized knowledge bases and passes it to the vector database's search method with the expectation that the filter will be applied. However, eleven of the fifteen shipped vector backends (both Qdrant clients, Elasticsearch, OpenSearch, both Milvus clients, openGauss, Oracle 23ai, Pinecone, S3 Vectors, and Weaviate) declare a filter parameter but never apply it in their search implementations, while their query methods correctly apply filtering. The default Chroma backend and pgvector, MariaDB, and Valkey backends are unaffected. An authenticated user without elevated privileges can call a model configured with the knowledge tool enabled (the default) to enumerate all knowledge base identifiers, names, and descriptions in the shared collection, regardless of access restrictions. The exposure is limited to metadata; actual document text is stored in separate per-knowledge-base collections and is not returned. Fixed in version 0.11.1 by ensuring all backends apply the caller-supplied filter in their search method.

## Affected products

- Open WebUI open-webui 0.7.0 to 0.11.0

## Identifiers

- CVE-2026-87017
- GHSA-pcvc-8vrv-8q6w
- PYSEC-2026-4125

## Timeline

- 2026-09-10: disclosed: Vulnerability published in GitHub Advisory Database
- 2026-09-10: patched: Fix available in version 0.11.1 via commit 1d6d4e6e6

## References

- [https://api.github.com/users/Classic298](https://api.github.com/users/Classic298)
- [https://github.com/Classic298](https://github.com/Classic298)
- [https://api.github.com/users/Classic298/gists%7B/gist_id%7D](https://api.github.com/users/Classic298/gists%7B/gist_id%7D)
- [https://api.github.com/users/Classic298/repos](https://api.github.com/users/Classic298/repos)
- [https://avatars.githubusercontent.com/u/27028174?v=4](https://avatars.githubusercontent.com/u/27028174?v=4)
- [https://api.github.com/users/Classic298/events%7B/privacy%7D](https://api.github.com/users/Classic298/events%7B/privacy%7D)

## Related threats

- [Open WebUI OAuth token exchange authorization bypass](https://junglewise.ai/threats/cve-2026-88006-open-webui-oauth-token-exchange-authorization-bypass)
- [Open WebUI OAuth token exchange authorization bypass](https://junglewise.ai/threats/cve-2026-88005-open-webui-oauth-token-exchange-authorization-bypass)
- [Open WebUI infinite loop denial of service in chat history reconstruction](https://junglewise.ai/threats/cve-2026-88002-open-webui-infinite-loop-denial-of-service-in-chat-history)
- [Open WebUI server-side request forgery via unvalidated HTTP redirects](https://junglewise.ai/threats/cve-2026-88001-open-webui-server-side-request-forgery-via-unvalidated-http)
- [Open WebUI denial of service via cyclic chat tree message deletion](https://junglewise.ai/threats/cve-2026-88000-open-webui-denial-of-service-via-cyclic-chat-tree-message)