Skip to content
Heist/ feed
UnratedFix available

Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

Type: advisorySource: OSV2 source records

## Summary The built-in knowledge search tool returns knowledge bases the calling user has no access to. The tool works out which knowledge bases the caller may read and hands that set to the vector store as a search filter, and that filter is the only access control on the path. Most of the shipped vector backends accept the filter argument on their search method and never apply it, so the search returns matches from every knowledge base in the shared collection. The sibling query method on those same backends does apply a filter, which is why the omission is invisible from the calling code. ## Preconditions - The deployment must use one of the affected vector backends, selected with `VECTOR_DB`, which defaults to `chroma`. Chroma applies the filter, so a default deployment is not affected. - Eleven of the fifteen shipped backends ignore the filter: both Qdrant clients, Elasticsearch, OpenSearch, both Milvus clients, openGauss, Oracle 23ai, Pinecone, S3 Vectors and Weaviate. Chroma, pgvector, MariaDB and Valkey apply it and were never affected. - The caller needs a model that can call tools, with the knowledge built-in tools left enabled, which is the default, and with no knowledge attached to the model itself. No elevated role or permission is required. - At least one knowledge base must exist that the caller cannot otherwise read. ## Impact A user receives the identifier, name and description of knowledge bases that were never shared with them, and chooses how many results

Announced Group revision 1
Original source ↗

PYSEC-2026-4125

Revision 1

Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

## Summary The built-in knowledge search tool returns knowledge bases the calling user has no access to. The tool works out which knowledge bases the caller may read and hands that set to the vector store as a search filter, and that filter is the only access control on the path. Most of the shipped vector backends accept the filter argument on their search method and never apply it, so the search returns matches from every knowledge base in the shared collection. The sibling query method on those same backends does apply a filter, which is why the omission is invisible from the calling code. ## Preconditions - The deployment must use one of the affected vector backends, selected with `VECTOR_DB`, which defaults to `chroma`. Chroma applies the filter, so a default deployment is not affected. - Eleven of the fifteen shipped backends ignore the filter: both Qdrant clients, Elasticsearch, OpenSearch, both Milvus clients, openGauss, Oracle 23ai, Pinecone, S3 Vectors and Weaviate. Chroma, pgvector, MariaDB and Valkey apply it and were never affected. - The caller needs a model that can call tools, with the knowledge built-in tools left enabled, which is the default, and with no knowledge attached to the model itself. No elevated role or permission is required. - At least one knowledge base must exist that the caller cannot otherwise read. ## Impact A user receives the identifier, name and description of knowledge bases that were never shared with them, and chooses how many results

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:PYSEC-2026-4125

open-webui

Source reference: /affected/0/package/name

Affected versions
0.10.0

Source reference: /affected/0/versions

0.10.1

Source reference: /affected/0/versions

0.10.2

Source reference: /affected/0/versions

0.11.0

Source reference: /affected/0/versions

0.7.0

Source reference: /affected/0/versions

0.7.1

Source reference: /affected/0/versions

0.7.2

Source reference: /affected/0/versions

0.8.0

Source reference: /affected/0/versions

0.8.1

Source reference: /affected/0/versions

0.8.10

Source reference: /affected/0/versions

0.8.11

Source reference: /affected/0/versions

0.8.12

Source reference: /affected/0/versions

0.8.2

Source reference: /affected/0/versions

0.8.3

Source reference: /affected/0/versions

0.8.4

Source reference: /affected/0/versions

0.8.5

Source reference: /affected/0/versions

0.8.6

Source reference: /affected/0/versions

0.8.7

Source reference: /affected/0/versions

0.8.8

Source reference: /affected/0/versions

0.8.9

Source reference: /affected/0/versions

0.9.0

Source reference: /affected/0/versions

0.9.1

Source reference: /affected/0/versions

0.9.2

Source reference: /affected/0/versions

0.9.3

Source reference: /affected/0/versions

0.9.4

Source reference: /affected/0/versions

0.9.5

Source reference: /affected/0/versions

0.9.6

Source reference: /affected/0/versions

Fixed versions
0.11.1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0.7.0"
          },
          {
            "fixed": "0.11.1"
          }
        ]
      }
    ],
    "package": {
      "name": "open-webui",
      "purl": "pkg:pypi/open-webui",
      "ecosystem": "PyPI"
    },
    "versions": [
      "0.10.0",
      "0.10.1",
      "0.10.2",
      "0.11.0",
      "0.7.0",
      "0.7.1",
      "0.7.2",
      "0.8.0",
      "0.8.1",
      "0.8.10",
      "0.8.11",
      "0.8.12",
      "0.8.2",
      "0.8.3",
      "0.8.4",
      "0.8.5",
      "0.8.6",
      "0.8.7",
      "0.8.8",
      "0.8.9",
      "0.9.0",
      "0.9.1",
      "0.9.2",
      "0.9.3",
      "0.9.4",
      "0.9.5",
      "0.9.6"
    ],
    "database_specific": {
      "source": "https://github.com/pypa/advisory-database/blob/main/vulns/open-webui/PYSEC-2026-4125.yaml"
    }
  }
]
Related CVEs
CVE-2026-87017

Source reference: /aliases

Publisher severity

No explicit severity was provided.

Event
#62505 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement

GHSA-pcvc-8vrv-8q6w

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-pcvc-8vrv-8q6w

open-webui

Source reference: /affected/0/package/name

Affected versions
0.10.0

Source reference: /affected/0/versions

0.10.1

Source reference: /affected/0/versions

0.10.2

Source reference: /affected/0/versions

0.11.0

Source reference: /affected/0/versions

0.7.0

Source reference: /affected/0/versions

0.7.1

Source reference: /affected/0/versions

0.7.2

Source reference: /affected/0/versions

0.8.0

Source reference: /affected/0/versions

0.8.1

Source reference: /affected/0/versions

0.8.10

Source reference: /affected/0/versions

0.8.11

Source reference: /affected/0/versions

0.8.12

Source reference: /affected/0/versions

0.8.2

Source reference: /affected/0/versions

0.8.3

Source reference: /affected/0/versions

0.8.4

Source reference: /affected/0/versions

0.8.5

Source reference: /affected/0/versions

0.8.6

Source reference: /affected/0/versions

0.8.7

Source reference: /affected/0/versions

0.8.8

Source reference: /affected/0/versions

0.8.9

Source reference: /affected/0/versions

0.9.0

Source reference: /affected/0/versions

0.9.1

Source reference: /affected/0/versions

0.9.2

Source reference: /affected/0/versions

0.9.3

Source reference: /affected/0/versions

0.9.4

Source reference: /affected/0/versions

0.9.5

Source reference: /affected/0/versions

0.9.6

Source reference: /affected/0/versions

Fixed versions
0.11.1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0.7.0"
          },
          {
            "fixed": "0.11.1"
          }
        ]
      }
    ],
    "package": {
      "name": "open-webui",
      "purl": "pkg:pypi/open-webui",
      "ecosystem": "PyPI"
    },
    "versions": [
      "0.10.0",
      "0.10.1",
      "0.10.2",
      "0.11.0",
      "0.7.0",
      "0.7.1",
      "0.7.2",
      "0.8.0",
      "0.8.1",
      "0.8.10",
      "0.8.11",
      "0.8.12",
      "0.8.2",
      "0.8.3",
      "0.8.4",
      "0.8.5",
      "0.8.6",
      "0.8.7",
      "0.8.8",
      "0.8.9",
      "0.9.0",
      "0.9.1",
      "0.9.2",
      "0.9.3",
      "0.9.4",
      "0.9.5",
      "0.9.6"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-pcvc-8vrv-8q6w/GHSA-pcvc-8vrv-8q6w.json",
      "last_known_affected_version_range": "<= 0.11.0"
    }
  }
]
Related CVEs
CVE-2026-87017

Source reference: /aliases

Publisher severity

No explicit severity was provided.

Event
#62529 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement

Revision history

  1. GHSA-pcvc-8vrv-8q6w · Revision 1Source updated
  2. PYSEC-2026-4125 · Revision 1Source updated