Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

🗓️ 01 Oct 2026 16:38:29Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 2 Views

Open WebUI built-in knowledge tool discloses knowledge base metadata via vector backends.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2026-87017	10 Sep 202616:35	–	circl
CVE	CVE-2026-87017	9 Sep 202621:23	–	cve
Cvelist	CVE-2026-87017 Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends	9 Sep 202621:23	–	cvelist
EUVD	EUVD-2026-75177	10 Sep 202615:10	–	euvd
Github Security Blog	Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends	10 Sep 202615:10	–	github
NVD	CVE-2026-87017	9 Sep 202622:18	–	nvd
OSV	GHSA-PCVC-8VRV-8Q6W Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends	10 Sep 202615:10	–	osv
OSV	PYSEC-2026-4125 Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends	1 Oct 202616:38	–	osv
Positive Technologies	PT-2026-89168	9 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-87017: Exposure of Sensitive Information to an Unauthorized Actor	9 Sep 202600:00	–	rapid7

Vulners

Node

pypi open-webuiRange0.7.0–0.11.1

Source	Link
github	www.github.com/open-webui/open-webui/security/advisories/GHSA-pcvc-8vrv-8q6w
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-87017
github	www.github.com/open-webui/open-webui/commit/1d6d4e6e6647e1d403438ede7bd9ba20bc4cc8f6
github	www.github.com/open-webui/open-webui
github	www.github.com/open-webui/open-webui/releases/tag/v0.11.1
pypi	www.pypi.org/project/open-webui
github	www.github.com/advisories/GHSA-pcvc-8vrv-8q6w

01 Oct 2026 17:10Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.14.3

EPSS0.00372

SSVC