Open WebUIGHSA-m69w-p7m4-585j

Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)

CVE-2026-45667 · Published May 14, 2026 · updated Jul 13, 2026

Medium6.5

Fix: upgrade to 0.8.0 or later

Summary

GET /api/v1/memories/ef is accessible without authentication and executes request.app.state.EMBEDDING_FUNCTION(...). This allows any unauthenticated caller to trigger embedding generation which can lead to direct cost exposure if a paid provider is used.

Code reference: backend/open_webui/routers/memories.py (@router.get("/ef") -> calls request.app.state.EMBEDDING_FUNCTION("hello world")).

Details

GET /api/v1/memories/ef is reachable without authentication and triggers request.app.state.EMBEDDING_FUNCTION("hello world"). This crosses an intended security boundary by allowing unauthenticated users to invoke potentially expensive embedding computation and/or paid upstream embedding APIs.

PoC

1. Start Open WebUI in default configuration (no special env hardening; default ENABLE_MEMORIES is true).

2. From an unauthenticated client (no cookies/Authorization header), call:

curl -i http://\<host\>:\<port\>/api/v1/memories/ef

3. Observe the server performs embedding generation and returns a response like:

HTTP 200 with JSON containing the result.

How it can be abused / attacker actions:

Send repeated requests to /api/v1/memories/ef to:
consume CPU/GPU resources (DoS)
generate sustained outbound usage to embedding providers if configured (cost + rate-limit exhaustion)
degrade latency/availability for legitimate users

###...

Affected versions

Package	Affected	Fixed in
open-webui PyPI	< 0.8.0	0.8.0

Details and references

### Summary GET `/api/v1/memories/ef` is accessible without authentication and executes `request.app.state.EMBEDDING_FUNCTION(...)`. This allows any unauthenticated caller to trigger embedding generation which can lead to direct cost exposure if a paid provider is used. Code reference: `backend/open_webui/routers/memories.py` (@router.get("/ef") -> calls `request.app.state.EMBEDDING_FUNCTION("hello world"))`. ### Details GET `/api/v1/memories/ef` is reachable without authentication and triggers request.app.state.EMBEDDING_FUNCTION("hello world"). This crosses an intended security boundary by allowing unauthenticated users to invoke potentially expensive embedding computation and/or paid upstream embedding APIs. ### PoC 1. Start Open WebUI in default configuration (no special env hardening; default ENABLE_MEMORIES is true). 2. From an unauthenticated client (no cookies/Authorization header), call: curl -i http://\<host\>:\<port\>/api/v1/memories/ef 3. Observe the server performs embedding generation and returns a response like: - HTTP 200 with JSON containing the result. How it can be abused / attacker actions: - Send repeated requests to `/api/v1/memories/ef` to: - consume CPU/GPU resources (DoS) - generate sustained outbound usage to embedding providers if configured (cost + rate-limit exhaustion) - degrade latency/availability for legitimate users ### Impact If embeddings are configured to use paid/remote providers (OpenAI/Azure/etc), an attacker can generate unlimited requests and incur charges. ## Resolution Fixed in commit [e5035ea31](https://github.com/open-webui/open-webui/commit/e5035ea31e179977e805a7032c979ff59a71860a), first released in **v0.8.0** (Feb 2026). The `/api/v1/memories/ef` route was removed entirely. It was a diagnostic/debug-style endpoint that hard-coded `"hello world"` through the embedding function without any authentication dependency; there was no legitimate caller that depended on it, so deletion was the cleaner fix than retrofitting auth. Users on `>= 0.8.0` are not affected.

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Severity from: GitHub (reviewed advisory)
Weakness: CWE-862
Also known as: CVE-2026-45667, PYSEC-2026-2747

More Open WebUI advisories

All Open WebUI

High 8.1May 14

Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin AccountsCVE-2026-45675fixed in 0.9.0 High 8.8May 14

Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` , feature gate bypassedCVE-2026-45672fixed in 0.8.12 High 8.0May 14

Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletionCVE-2026-45671fixed in 0.9.0 Medium 6.5May 14

Open WebUI has an Indirect Object Reference (IDOR) in user notesCVE-2026-45666fixed in 0.8.11 High 8.1May 14

Open WebUI: insecure direct object referenceCVE-2026-45402fixed in 0.9.5 High 7.3May 14

Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_urlCVE-2026-56398fixed in 0.9.5