CVE-2026-87998: Open WebUI privilege escalation in external knowledge connection deletion

CVE-2026-87998 · Severity: high · CVSS 7.1 · Published 2026-09-09

Open WebUI is a framework for managing and interfacing with large language models and knowledge bases. The vulnerability allows ordinary users to delete shared database connections that administrators create and manage, causing service disruption. When a user deletes a knowledge base that uses a shared external database connection, the connection is removed from instance configuration without checking whether other knowledge bases depend on it. This breaks those other knowledge bases' ability to retrieve information until an administrator manually restores the connection with the original credentials.

Technologies: open-webui (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-87998 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-87998 being exploited in the wild.
How severe is CVE-2026-87998?
High severity, with a CVSS score of 7.1, published 9 September 2026.
Which products and versions are affected?
open-webui (PyPI) >= 0.10.0, < 0.11.1, ECOSYSTEM:introduced=0.10.0,fixed=0.11.1.
Is there a fix for CVE-2026-87998?
Yes. open-webui (PyPI): upgrade to 0.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87998 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-87998?
Check whether you run open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • open-webui (PyPI): upgrade to 0.11.1 or later
    pip install "open-webui>=0.11.1"

Technical details

The vulnerability is a missing authorization check in the knowledge base deletion handler (DELETE /api/v1/knowledge/{id}/delete in backend/open_webui/routers/knowledge.py). The handler authorizes the caller against the specific knowledge base (write grant sufficient), then performs an unrelated operation on global configuration—removing the associated external database connection—without checking the caller's role or verifying that other knowledge bases still depend on that connection. The dedicated admin route for deleting connections (DELETE /api/v1/knowledge/external/connections/{id}) correctly performs both checks, but the vulnerability exists because the knowledge base route bypasses them. Exploitation requires the deployment to use external knowledge bases (qdrant, milvus, or pgvector backends) and the attacker to hold write access on at least one knowledge base. Patch 0.11.1 restricts connection removal to administrators and only removes the connection if no other knowledge bases reference it.

Affected products

  • open-webui open-webui >= 0.10.0, < 0.11.1

Identifiers

  • CVE-2026-87998
  • GHSA-2724-6cpj-gf3v
  • PYSEC-2026-4115

Timeline

  • 2026-09-10: disclosed: Published in GitHub Advisory Database
  • 2026-09-10: patched: Fixed in version 0.11.1 via PR #28113

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.