Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, GET /api/v1/memories/ef is accessible without authentication and executes request.app.state.EMBEDDING_FUNCTION(...). This allows any unauthenticated caller to trigger embedding generation which can lead to direct cost exposure if a paid provider is used. This vulnerability is fixed in 0.8.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-16 | 1 | Patch1 |
| 2026-05-17 | 1 | Disclosure1 |
🚨 CVE-2026-45667 CRITICAL: Open WebUI self-hosted AI platform has an unpatched critical flaw. Enterprises running private LLMs exposed to full compromise. AI infra is the new primary attack surface. Patch NOW. http://lyrie.ai/research #CyberSecurity
Post summary
The post announces a critical vulnerability (CVE‑2026‑45667) in the Open WebUI AI platform, calling for immediate patching, but offers no technical or exploit details.
CVE-2026-45667 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, GET /api/v1/memories/ef is accessible without authe… https://www.cve.org/CVERecord?id=CVE-2026-45667
Post summary
CVE-2026-45667 exposes unauthenticated access to an API endpoint in Open WebUI prior to version 0.8.0; upgrading to 0.8.0 mitigates the vulnerability.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openwebui | open_webui | - | - | - |