CVE-2026-54019— Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode
Quick assessment
Affected
open-webui open-webui
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Open WebUI是Open WebUI团队开源的一个可扩展、功能丰富、用户友好的自托管 WebUI。 Open WebUI 0.9.6之前版本存在安全漏洞，该漏洞源于对CVE-2026-44560的修复不完整，当启用Milvus多租户模式时ACL检查可被绕过，用户控制的集合名作为resource_id未转义地插入Milvus表达式，可能导致权限提升。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| open-webui | open-webui | < 0.9.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54019
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode
Source: CVE Program / CVE List V5
Vulnerability Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI added collection-level ACL checks, but the patch can still be bypassed when Milvus multitenancy mode is enabled. The ACL allows unknown non-KB collection names as legacy/ephemeral collections. In Milvus multitenancy mode, that user-controlled collection name becomes a resource_id and is interpolated into a Milvus expression without escaping. This is caused by an incomplete fix for CVE-2026-44560 This vulnerability is fixed in 0.9.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Open WebUI 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Open WebUI是Open WebUI团队开源的一个可扩展、功能丰富、用户友好的自托管 WebUI。 Open WebUI 0.9.6之前版本存在安全漏洞，该漏洞源于对CVE-2026-44560的修复不完整，当启用Milvus多租户模式时ACL检查可被绕过，用户控制的集合名作为resource_id未转义地插入Milvus表达式，可能导致权限提升。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| open-webui | open-webui | < 0.9.6 | - |
|
II. Public POCs for CVE-2026-54019
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54019
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-54019 (1)
Same Patch Batch · open-webui · 2026-06-23 · 15 CVEs total
| CVE-2026-54011 | 8.7 HIGH | Open WebUI: Stored XSS in Mermaid Markdown Preview |
| CVE-2026-54008 | 8.5 HIGH | Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` |
| CVE-2026-54010 | 8.3 HIGH | Open WebUI: Forged chat-file link allows cross-user file read and deletion |
| CVE-2026-54018 | 7.7 HIGH | Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects |
| CVE-2026-54013 | 7.6 HIGH | Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI |
| CVE-2026-54012 | 7.1 HIGH | Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion |
| CVE-2026-54009 | 6.5 MEDIUM | Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field |
| CVE-2026-54015 | 6.4 MEDIUM | Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion |
| CVE-2026-54021 | 6.3 MEDIUM | Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguar |
| CVE-2026-54022 | 5.3 MEDIUM | Open WebUI: Any authenticated user can read other users' private notes via Socket.IO |
| CVE-2026-54016 | 4.3 MEDIUM | Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base F |
| CVE-2026-54006 | 4.3 MEDIUM | Open WebUI: Calendar event re-parenting allows writing events into another user's calendar |
| CVE-2026-54014 | 4.3 MEDIUM | Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui |
| CVE-2026-54007 | Open WebUI: Cross-origin postMessage confirmation bypass via action:submit |
IV. Related Vulnerabilities
Same product: open-webui
-
CVE-2026-88006
Open WebUI: Users denied by the OAuth role policy can still -
CVE-2026-88005
Open WebUI: Users denied by the OAuth domain allowlist or ro -
CVE-2026-88002
Open WebUI: Any authenticated user can hang the server via a -
CVE-2026-88001
Open WebUI: Server-side fetches reach blocked and internal h -
CVE-2026-88000
Open WebUI: Any authenticated user can hang the server via m
Same vendor: open-webui
-
CVE-2026-88006
Open WebUI: Users denied by the OAuth role policy can still -
CVE-2026-88005
Open WebUI: Users denied by the OAuth domain allowlist or ro -
CVE-2026-88002
Open WebUI: Any authenticated user can hang the server via a -
CVE-2026-88001
Open WebUI: Server-side fetches reach blocked and internal h -
CVE-2026-88000
Open WebUI: Any authenticated user can hang the server via m
Same weakness: CWE-862
-
CVE-2026-11601
WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated -
CVE-2026-94505
Nelio Content <= 4.5.0 - Missing Authorization to Authentica -
CVE-2026-101923
Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorizat -
CVE-2026-97337
Simple Membership <= 4.8.3 - Missing Authorization to Unauth -
CVE-2026-91108
Alt Text AI <= 1.10.41 - Missing Authorization to Authentica
V. Comments for CVE-2026-54019
No comments yet