PYSEC-2026-2706

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/open-webui/PYSEC-2026-2706.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-2706

Aliases

Published

2026-07-13T15:19:07Z

Modified

2026-07-13T16:32:23Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure

Details

Vulnerability Type: Information Disclosure / Missing Authentication
Severity: Medium
Component: backend/open_webui/routers/retrieval.py — get_status() (GET /)
Affected Endpoint: GET /api/v1/retrieval/
Affected Version: Open WebUI main branch — confirmed unpatched through v0.9.2
Authentication Required: None — internet-facing with zero credentials
CVSSv3.1 Score: 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Summary

GET /api/v1/retrieval/ returns live RAG pipeline configuration to any unauthenticated HTTP client. No Authorization header, cookie, or API key is required. Every adjacent endpoint on the same router (/embedding, /config) is correctly guarded by get_admin_user making this a targeted omission.

Root Cause

backend/open_webui/routers/retrieval.py:262

@router.get('/')
async def get_status(request: Request):   # ← no Depends(get_verified_user)
    return {
        'status': True,
        'CHUNK_SIZE': request.app.state.config.CHUNK_SIZE,
        'CHUNK_OVERLAP': request.app.state.config.CHUNK_OVERLAP,
        'RAG_TEMPLATE': request.app.state.config.RAG_TEMPLATE,
        'RAG_EMBEDDING_ENGINE': request.app.state.config.RAG_EMBEDDING_ENGINE,
        'RAG_EMBEDDING_MODEL': request.app.state.config.RAG_EMBEDDING_MODEL,
        'RAG_RERANKING_MODEL': request.app.state.config.RAG_RERANKING_MODEL,
        'RAG_EMBEDDING_BATCH_SIZE': request.app.state.config.RAG_EMBEDDING_BATCH_SIZE,
        'ENABLE_ASYNC_EMBEDDING': request.app.state.config.ENABLE_ASYNC_EMBEDDING,
        'RAG_EMBEDDING_CONCURRENT_REQUESTS': request.app.state.config.RAG_EMBEDDING_CONCURRENT_REQUESTS,
    }

Compare with every adjacent endpoint on the same router:

@router.get('/embedding')
async def get_embedding_config(request: Request, user=Depends(get_admin_user)):  # ✅

@router.get('/config')
async def get_rag_config(request: Request, user=Depends(get_admin_user)):        # ✅

Proof Of Concept — No Token Required

curl -s http://TARGET/api/v1/retrieval/

{
  "status": true,
  "CHUNK_SIZE": 1000,
  "CHUNK_OVERLAP": 100,
  "RAG_TEMPLATE": "### Task:\nRespond to the user query using the provided context...\n<context>\n{{CONTEXT}}\n</context>",
  "RAG_EMBEDDING_ENGINE": "",
  "RAG_EMBEDDING_MODEL": "sentence-transformers/all-MiniLM-L6-v2",
  "RAG_RERANKING_MODEL": "",
  "RAG_EMBEDDING_BATCH_SIZE": 1,
  "ENABLE_ASYNC_EMBEDDING": true,
  "RAG_EMBEDDING_CONCURRENT_REQUESTS": 0
}

Disclosed Information and Its Value to an Attacker

Field	What it reveals
`RAG_EMBEDDING_ENGINE`	Backend type (OpenAI, Ollama, Azure, etc.)
`RAG_EMBEDDING_MODEL`	Exact model name — reveals embedding model
`RAG_RERANKING_MODEL`	Reranker in use — reveals reranker
`RAG_TEMPLATE`	RAG template — exposes the RAG template
`CHUNK_SIZE` / `CHUNK_OVERLAP`	Chunking parameters — enables exact reconstruction of how documents are split and retrieved

Attack Scenario

Attacker sends one unauthenticated HTTP GET to /api/v1/retrieval/.
Response reveals the embedding model and chunking parameters.
Attacker uses the exact chunk size/overlap to craft RAG poisoning payloads that are guaranteed to be retrieved.

Impact

RAG template disclosure
Infrastructure fingerprinting — embedding engine and model name reveal the AI stack to an internet scanner
RAG attack surface mapping — chunk parameters enable precise calculation of retrieval boundaries
Zero-effort recon — no brute force, no credentials, no rate-limit concern. Single request from any IP.

Recommended Fix

Add get_verified_user dependency (or get_admin_user for stricter control):

# BEFORE (vulnerable)
@router.get('/')
async def get_status(request: Request):


# AFTER
@router.get('/')
async def get_status(request: Request, user=Depends(get_verified_user)):

References

Affected packages

PyPI / open-webui

Package

Name: open-webui; View open source insights on deps.dev
Purl: pkg:pypi/open-webui

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.9.5

Affected versions

0.*

0.1.124

0.1.125

0.2.0

0.2.1

0.2.2

0.2.3

0.2.4

0.2.5

0.3.0

0.3.1

0.3.2

0.3.3

0.3.4

0.3.5

0.3.6

0.3.7

0.3.8

0.3.9

0.3.10

0.3.12

0.3.13

0.3.14

0.3.15

0.3.16

0.3.17.dev2

0.3.17.dev3

0.3.17.dev4

0.3.17.dev5

0.3.17

0.3.18

0.3.19

0.3.20

0.3.21

0.3.22

0.3.23

0.3.24

0.3.25

0.3.26

0.3.27.dev1

0.3.27.dev2

0.3.27.dev3

0.3.27

0.3.28

0.3.29

0.3.30.dev1

0.3.30.dev2

0.3.30

0.3.31.dev1

0.3.31

0.3.32

0.3.33.dev1

0.3.33

0.3.34

0.3.35

0.4.0.dev1

0.4.0.dev2

0.4.0

0.4.1

0.4.2

0.4.3

0.4.4

0.4.5

0.4.6.dev1

0.4.6

0.4.7

0.4.8

0.5.0.dev1

0.5.0.dev2

0.5.0

0.5.1

0.5.2

0.5.3.dev1

0.5.3

0.5.4

0.5.5

0.5.6

0.5.7

0.5.8

0.5.9

0.5.10

0.5.11

0.5.12

0.5.13

0.5.14

0.5.15

0.5.16

0.5.17

0.5.18

0.5.19

0.5.20

0.6.0

0.6.1

0.6.2

0.6.3

0.6.4

0.6.5

0.6.6.dev1

0.6.6

0.6.7

0.6.8

0.6.9

0.6.10

0.6.11

0.6.12

0.6.13

0.6.14

0.6.15

0.6.16

0.6.18

0.6.19

0.6.20

0.6.21

0.6.22

0.6.23

0.6.24

0.6.25

0.6.26.dev1

0.6.26

0.6.27

0.6.28

0.6.29

0.6.30

0.6.31

0.6.32

0.6.33

0.6.34

0.6.35

0.6.36

0.6.37

0.6.38

0.6.39

0.6.40

0.6.41

0.6.42

0.6.43

0.7.0

0.7.1

0.7.2

0.8.0

0.8.1

0.8.2

0.8.3

0.8.4

0.8.5

0.8.6

0.8.7

0.8.8

0.8.9

0.8.10

0.8.11

0.8.12

0.9.0

0.9.1

0.9.2

0.9.3

0.9.4

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/open-webui/PYSEC-2026-2706.yaml"