{"id":"PYSEC-2026-2706","summary":"Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure","details":"**Vulnerability Type:** Information Disclosure / Missing Authentication  \n**Severity:** Medium  \n**Component:** `backend/open_webui/routers/retrieval.py` — `get_status()` (`GET /`)  \n**Affected Endpoint:** `GET /api/v1/retrieval/`  \n**Affected Version:** Open WebUI `main` branch — confirmed unpatched through **v0.9.2**  \n**Authentication Required:** None — internet-facing with zero credentials  \n**CVSSv3.1 Score:** 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)\n\n---\n\n## Summary\n\n`GET /api/v1/retrieval/` returns live RAG pipeline configuration to any unauthenticated HTTP client. No `Authorization` header, cookie, or API key is required. Every adjacent endpoint on the same router (`/embedding`, `/config`) is correctly guarded by `get_admin_user` making this a targeted omission.\n\n---\n\n## Root Cause\n\n`backend/open_webui/routers/retrieval.py:262`\n\n```python\n@router.get('/')\nasync def get_status(request: Request):   # ← no Depends(get_verified_user)\n    return {\n        'status': True,\n        'CHUNK_SIZE': request.app.state.config.CHUNK_SIZE,\n        'CHUNK_OVERLAP': request.app.state.config.CHUNK_OVERLAP,\n        'RAG_TEMPLATE': request.app.state.config.RAG_TEMPLATE,\n        'RAG_EMBEDDING_ENGINE': request.app.state.config.RAG_EMBEDDING_ENGINE,\n        'RAG_EMBEDDING_MODEL': request.app.state.config.RAG_EMBEDDING_MODEL,\n        'RAG_RERANKING_MODEL': request.app.state.config.RAG_RERANKING_MODEL,\n        'RAG_EMBEDDING_BATCH_SIZE': request.app.state.config.RAG_EMBEDDING_BATCH_SIZE,\n        'ENABLE_ASYNC_EMBEDDING': request.app.state.config.ENABLE_ASYNC_EMBEDDING,\n        'RAG_EMBEDDING_CONCURRENT_REQUESTS': request.app.state.config.RAG_EMBEDDING_CONCURRENT_REQUESTS,\n    }\n```\n\nCompare with every adjacent endpoint on the same router:\n\n```python\n@router.get('/embedding')\nasync def get_embedding_config(request: Request, user=Depends(get_admin_user)):  # ✅\n\n@router.get('/config')\nasync def get_rag_config(request: Request, user=Depends(get_admin_user)):        # ✅\n```\n\n---\n\n## Proof Of Concept — No Token Required\n\n```bash\ncurl -s http://TARGET/api/v1/retrieval/\n```\n\n```json\n{\n  \"status\": true,\n  \"CHUNK_SIZE\": 1000,\n  \"CHUNK_OVERLAP\": 100,\n  \"RAG_TEMPLATE\": \"### Task:\\nRespond to the user query using the provided context...\\n\u003ccontext\u003e\\n{{CONTEXT}}\\n\u003c/context\u003e\",\n  \"RAG_EMBEDDING_ENGINE\": \"\",\n  \"RAG_EMBEDDING_MODEL\": \"sentence-transformers/all-MiniLM-L6-v2\",\n  \"RAG_RERANKING_MODEL\": \"\",\n  \"RAG_EMBEDDING_BATCH_SIZE\": 1,\n  \"ENABLE_ASYNC_EMBEDDING\": true,\n  \"RAG_EMBEDDING_CONCURRENT_REQUESTS\": 0\n}\n```\n\n---\n\n## Disclosed Information and Its Value to an Attacker\n\n| Field | What it reveals |\n|---|---|\n| `RAG_EMBEDDING_ENGINE` | Backend type (OpenAI, Ollama, Azure, etc.) |\n| `RAG_EMBEDDING_MODEL` | Exact model name — reveals embedding model |\n| `RAG_RERANKING_MODEL` | Reranker in use — reveals reranker |\n| `RAG_TEMPLATE` | **RAG template** — exposes the RAG template |\n| `CHUNK_SIZE` / `CHUNK_OVERLAP` | Chunking parameters — enables exact reconstruction of how documents are split and retrieved |\n\n---\n\n## Attack Scenario\n\n1. Attacker sends one unauthenticated HTTP GET to `/api/v1/retrieval/`.\n2. Response reveals the embedding model and chunking parameters.\n3. Attacker uses the exact chunk size/overlap to craft RAG poisoning payloads that are guaranteed to be retrieved.\n\n---\n\n## Impact\n\n1. **RAG template disclosure**\n2. **Infrastructure fingerprinting** — embedding engine and model name reveal the AI stack to an internet scanner\n3. **RAG attack surface mapping** — chunk parameters enable precise calculation of retrieval boundaries\n4. **Zero-effort recon** — no brute force, no credentials, no rate-limit concern. Single request from any IP.\n\n---\n\n## Recommended Fix\n\nAdd `get_verified_user` dependency (or `get_admin_user` for stricter control):\n\n```python\n# BEFORE (vulnerable)\n@router.get('/')\nasync def get_status(request: Request):\n\n\n# AFTER\n@router.get('/')\nasync def get_status(request: Request, user=Depends(get_verified_user)):\n```","aliases":["CVE-2026-45397","GHSA-65pg-qhhw-mxwg"],"modified":"2026-07-13T16:32:23.900870444Z","published":"2026-07-13T15:19:07.447769Z","references":[{"type":"WEB","url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-65pg-qhhw-mxwg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45397"},{"type":"PACKAGE","url":"https://github.com/open-webui/open-webui"},{"type":"WEB","url":"https://github.com/open-webui/open-webui/releases/tag/v0.9.5"},{"type":"PACKAGE","url":"https://pypi.org/project/open-webui"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-65pg-qhhw-mxwg"}],"affected":[{"package":{"name":"open-webui","ecosystem":"PyPI","purl":"pkg:pypi/open-webui"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5"}]}],"versions":["0.1.124","0.1.125","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.3.0","0.3.1","0.3.10","0.3.12","0.3.13","0.3.14","0.3.15","0.3.16","0.3.17","0.3.17.dev2","0.3.17.dev3","0.3.17.dev4","0.3.17.dev5","0.3.18","0.3.19","0.3.2","0.3.20","0.3.21","0.3.22","0.3.23","0.3.24","0.3.25","0.3.26","0.3.27","0.3.27.dev1","0.3.27.dev2","0.3.27.dev3","0.3.28","0.3.29","0.3.3","0.3.30","0.3.30.dev1","0.3.30.dev2","0.3.31","0.3.31.dev1","0.3.32","0.3.33","0.3.33.dev1","0.3.34","0.3.35","0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.3.9","0.4.0","0.4.0.dev1","0.4.0.dev2","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.6.dev1","0.4.7","0.4.8","0.5.0","0.5.0.dev1","0.5.0.dev2","0.5.1","0.5.10","0.5.11","0.5.12","0.5.13","0.5.14","0.5.15","0.5.16","0.5.17","0.5.18","0.5.19","0.5.2","0.5.20","0.5.3","0.5.3.dev1","0.5.4","0.5.5","0.5.6","0.5.7","0.5.8","0.5.9","0.6.0","0.6.1","0.6.10","0.6.11","0.6.12","0.6.13","0.6.14","0.6.15","0.6.16","0.6.18","0.6.19","0.6.2","0.6.20","0.6.21","0.6.22","0.6.23","0.6.24","0.6.25","0.6.26","0.6.26.dev1","0.6.27","0.6.28","0.6.29","0.6.3","0.6.30","0.6.31","0.6.32","0.6.33","0.6.34","0.6.35","0.6.36","0.6.37","0.6.38","0.6.39","0.6.4","0.6.40","0.6.41","0.6.42","0.6.43","0.6.5","0.6.6","0.6.6.dev1","0.6.7","0.6.8","0.6.9","0.7.0","0.7.1","0.7.2","0.8.0","0.8.1","0.8.10","0.8.11","0.8.12","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/open-webui/PYSEC-2026-2706.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}