CVE-2026-109285: Open WebUI: stale KB cache lets ex-collaborators read/delete files

MEDIUMCISA: TRACK*

Published October 12, 2026

CISO Take

Open WebUI versions 0.6.0 through 0.11.3 contain an improper access control flaw (CWE-863) in has_access_to_file: former knowledge base collaborators retain access to files through stale cached knowledge base references. Someone whose access was revoked can still download those files through the file content endpoint, or delete them, including files in the owner's private knowledge bases. Urgency is moderate: the CVSS is 5.0 with high attack complexity, the attacker needs a prior valid grant, there is no KEV listing, no public exploit, no Nuclei template and no EPSS data. Because Open WebUI is often used as an internal front end for RAG over proprietary documents, the real risk is confidentiality and integrity loss after offboarding or access revocation, not remote compromise. Upgrade to 0.11.4 or later, then review file access and deletion logs for activity by users whose knowledge base access was removed.

Sources:NVDGitHub AdvisoryVulnCheckATLASOpenSSF

What is the risk?

Medium. The attack is network-reachable but needs a low-privilege account that once held a read or write grant, and the high attack complexity reflects its dependence on stale cached references. Exploitation is not known in the wild, EPSS and SSVC data are unavailable, and no public exploit exists. Impact is limited to low confidentiality, integrity and availability loss for the affected files. It matters most in multi-user deployments where access is revoked regularly, such as contractors, departing staff or team reorganisations, and where knowledge bases hold sensitive documents. The package has 186 other CVEs, which points to a heavy ongoing patching burden.

How does the attack unfold?

Initial Access

A former collaborator logs in with a valid low-privilege account that once held read or write access to a knowledge base.

AML.T0012

Exploitation

The attacker calls the file content endpoint, and has_access_to_file accepts the stale cached knowledge base reference.

AML.T0049

Collection

The attacker downloads files from the knowledge base that they should no longer be able to read.

AML.T0036

Impact

The attacker deletes files, including from the owner's private knowledge bases, which degrades RAG content and removes data.

AML.T0101

Initial Access

A former collaborator logs in with a valid low-privilege account that once held read or write access to a knowledge base.

AML.T0012

Exploitation

The attacker calls the file content endpoint, and has_access_to_file accepts the stale cached knowledge base reference.

AML.T0049

Collection

The attacker downloads files from the knowledge base that they should no longer be able to read.

AML.T0036

Impact

The attacker deletes files, including from the owner's private knowledge bases, which degrades RAG content and removes data.

AML.T0101

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	—	No patch
156.7K3 dependentsPushed 6d ago76% patched~20d to patchFull package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

5.0 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 15% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACHigh

PRLow

UINone

SUnchanged

CLow

ILow

ALow

What should I do?

1 step

1) Upgrade open-webui to 0.11.4 or later (pip install -U open-webui, or pull the patched container image). 2) Until patched, restrict Open WebUI to trusted users and avoid granting knowledge base access to short-term or external accounts. 3) Where possible, remove stale cached references by restarting the service after access revocations, and consider disabling accounts of departed users entirely rather than only removing knowledge base grants. 4) Review access and application logs for file content download and delete requests from users who no longer have knowledge base grants. 5) Check that sensitive knowledge bases still contain the expected files, and restore from backup if anything is missing. 6) Rotate or reclassify content if unauthorised access is confirmed.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageRAGFrameworkAML.T0012- Valid Accounts AML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application AML.T0101- Data Destruction via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and maintain controls

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-109285?

Is CVE-2026-109285 actively exploited?

No confirmed active exploitation of CVE-2026-109285 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-109285?

1) Upgrade open-webui to 0.11.4 or later (pip install -U open-webui, or pull the patched container image). 2) Until patched, restrict Open WebUI to trusted users and avoid granting knowledge base access to short-term or external accounts. 3) Where possible, remove stale cached references by restarting the service after access revocations, and consider disabling accounts of departed users entirely rather than only removing knowledge base grants. 4) Review access and application logs for file content download and delete requests from users who no longer have knowledge base grants. 5) Check that sensitive knowledge bases still contain the expected files, and restore from backup if anything is missing. 6) Rotate or reclassify content if unauthorised access is confirmed.

What systems are affected by CVE-2026-109285?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, LLM web interfaces, Multi-user knowledge base deployments, Self-hosted LLM front ends.

What is the CVSS score for CVE-2026-109285?

CVE-2026-109285 has a CVSS v3.1 base score of 5.0 (MEDIUM). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesLLM web interfacesMulti-user knowledge base deploymentsSelf-hosted LLM front ends

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

AML.T0101Data Destruction via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file content endpoint or delete them, including from the owner's private knowledge bases.

Exploitation Scenario

A contractor is given read or write access to a shared knowledge base containing internal security policies and customer contracts. When the engagement ends, an administrator removes the contractor's grant, but the contractor's account remains active. Because has_access_to_file still trusts stale cached knowledge base references, the contractor calls the file content endpoint with the known file IDs and downloads documents they should no longer see. They can also send delete requests to remove files, including from the owner's private knowledge bases. This damages the RAG corpus and removes evidence.

Weaknesses (CWE)

CWE-863Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.