EUVD-2026-30629
GHSA-65pg-qhhw-mxwg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionGitHub Advisory
Vulnerability Type: Information Disclosure / Missing Authentication Severity: Medium Component: backend/open_webui/routers/retrieval.py - get_status() (GET /) Affected Endpoint: GET /api/v1/retrieval/ Affected Version: Open WebUI main branch - confirmed unpatched through v0.9.2 Authentication Required: None - internet-facing with zero credentials CVSSv3.1 Score: 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
---
Summary
GET /api/v1/retrieval/ returns live RAG pipeline configuration to any unauthenticated HTTP client. No Authorization header, cookie, or API key is required. Every adjacent endpoint on the same router (/embedding, /config) is correctly guarded by get_admin_user making this a targeted omission.
---
Root Cause
backend/open_webui/routers/retrieval.py:262
@router.get('/')
async def get_status(request: Request):
# ← no Depends(get_verified_user)
return {
'status': True,
'CHUNK_SIZE': request.app.state.config.CHUNK_SIZE,
'CHUNK_OVERLAP': request.app.state.config.CHUNK_OVERLAP,
'RAG_TEMPLATE': request.app.state.config.RAG_TEMPLATE,
'RAG_EMBEDDING_ENGINE': request.app.state.config.RAG_EMBEDDING_ENGINE,
'RAG_EMBEDDING_MODEL': request.app.state.config.RAG_EMBEDDING_MODEL,
'RAG_RERANKING_MODEL': request.app.state.config.RAG_RERANKING_MODEL,
'RAG_EMBEDDING_BATCH_SIZE': request.app.state.config.RAG_EMBEDDING_BATCH_SIZE,
'ENABLE_ASYNC_EMBEDDING': request.app.state.config.ENABLE_ASYNC_EMBEDDING,
'RAG_EMBEDDING_CONCURRENT_REQUESTS': request.app.state.config.RAG_EMBEDDING_CONCURRENT_REQUESTS,
}Compare with every adjacent endpoint on the same router:
@router.get('/embedding')
async def get_embedding_config(request: Request, user=Depends(get_admin_user)):
# ✅
@router.get('/config')
async def get_rag_config(request: Request, user=Depends(get_admin_user)):
# ✅---
Proof Of Concept - No Token Required
curl -s http://TARGET/api/v1/retrieval/{
"status": true,
"CHUNK_SIZE": 1000,
"CHUNK_OVERLAP": 100,
"RAG_TEMPLATE": "
### Task:\nRespond to the user query using the provided context...\n<context>\n{{CONTEXT}}\n</context>",
"RAG_EMBEDDING_ENGINE": "",
"RAG_EMBEDDING_MODEL": "sentence-transformers/all-MiniLM-L6-v2",
"RAG_RERANKING_MODEL": "",
"RAG_EMBEDDING_BATCH_SIZE": 1,
"ENABLE_ASYNC_EMBEDDING": true,
"RAG_EMBEDDING_CONCURRENT_REQUESTS": 0
}---
Disclosed Information and Its Value to an Attacker
| Field | What it reveals |
|---|---|
RAG_EMBEDDING_ENGINE | Backend type (OpenAI, Ollama, Azure, etc.) |
RAG_EMBEDDING_MODEL | Exact model name - reveals embedding model |
RAG_RERANKING_MODEL | Reranker in use - reveals reranker |
RAG_TEMPLATE | RAG template - exposes the RAG template |
CHUNK_SIZE / CHUNK_OVERLAP | Chunking parameters - enables exact reconstruction of how documents are split and retrieved |
---
Attack Scenario
- Attacker sends one unauthenticated HTTP GET to
/api/v1/retrieval/. - Response reveals the embedding model and chunking parameters.
- Attacker uses the exact chunk size/overlap to craft RAG poisoning payloads that are guaranteed to be retrieved.
---
Impact
- RAG template disclosure
- Infrastructure fingerprinting - embedding engine and model name reveal the AI stack to an internet scanner
- RAG attack surface mapping - chunk parameters enable precise calculation of retrieval boundaries
- Zero-effort recon - no brute force, no credentials, no rate-limit concern. Single request from any IP.
---
Recommended Fix
Add get_verified_user dependency (or get_admin_user for stricter control):
# BEFORE (vulnerable)
@router.get('/')
async def get_status(request: Request):
# AFTER
@router.get('/')
async def get_status(request: Request, user=Depends(get_verified_user)):AnalysisAI
Open WebUI's GET /api/v1/retrieval/ endpoint discloses RAG pipeline configuration including embedding models, chunking parameters, and RAG templates to unauthenticated attackers with a single HTTP request. The vulnerability affects v0.9.2 and earlier, where this endpoint lacks authentication guards present on all adjacent endpoints, enabling reconnaissance for RAG poisoning attacks and infrastructure fingerprinting without requiring credentials, authentication tokens, or user interaction.
Technical ContextAI
Open WebUI is a Python-based web interface using FastAPI routing for retrieval-augmented generation (RAG) pipelines. The vulnerable endpoint is in backend/open_webui/routers/retrieval.py at the root GET handler (/) which exposes application state configuration objects directly via HTTP without dependency injection of authentication checks. The CWE-306 (Missing Authentication for Critical Function) classifies this as a missing access control vulnerability where a critical status endpoint fails to apply the get_verified_user or get_admin_user dependency injectors that protect sibling endpoints (/embedding, /config) on the same router. The endpoint returns 10 configuration parameters from request.app.state.config including RAG_TEMPLATE (the actual retrieval prompt), embedding engine type, model names, and chunking algorithms. This configuration data is sensitive because it maps the internal AI stack architecture and enables attackers to calculate exact document chunk boundaries for targeted RAG injection attacks.
RemediationAI
Upgrade Open WebUI to v0.9.5 or later immediately. The patch adds the get_verified_user dependency to the GET /api/v1/retrieval/ endpoint, enforcing authentication matching the protection level of adjacent endpoints. For installations unable to upgrade immediately, implement network-level mitigations: (1) Restrict access to /api/v1/retrieval/ via WAF or reverse proxy to authenticated users only (deny unauthenticated requests with 403 Forbidden); (2) Place the endpoint behind an API gateway requiring Bearer token validation before forwarding to the backend; (3) Disable the retrieval router entirely if RAG functionality is not in use, though this requires backend restart. Authentication at the application layer is strongly preferred over network controls as the root cause is missing code-level access control. The remediation is straightforward because the fix (adding Depends(get_verified_user) to the function signature per the advisory) requires only a single line change.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today