CVE-2026-87998: Open WebUI authZ flaw lets users kill

Q: Is CVE-2026-87998 actively exploited?

No confirmed active exploitation of CVE-2026-87998 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-87998?

Upgrade to Open WebUI 0.11.1 or later immediately, which adds the missing administrator/dependency checks (see GHSA-2724-6cpj-gf3v and PR #28113). Until patched, restrict write access on external knowledge bases to trusted/admin-level users only, and avoid sharing a single external connection across knowledge bases owned by different low-privilege users. Audit existing knowledge base permissions for over-broad write grants. For detection, monitor application logs for DELETE requests to /api/v1/knowledge/{id}/delete originating from non-admin accounts, and alert on knowledge bases becoming unexpectedly unavailable shortly after such calls.

Q: What systems are affected by CVE-2026-87998?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, knowledge management / knowledge bases, shared external data connectors.

Q: What is the CVSS score for CVE-2026-87998?

CVE-2026-87998 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.27%.

CISO Take

A broken-access-control bug in Open WebUI's knowledge deletion endpoint lets any authenticated user with mere write access to one external knowledge base trigger deletion of the underlying, administrator-owned connection config — without a separate admin check or a check for other knowledge bases still depending on it. For a CISO, the concern isn't data theft (CVSS confidentiality impact is none) but availability and integrity: a low-privileged or compromised account can silently break RAG retrieval for every other team relying on that shared connection, a self-inflicted denial-of-service against your own knowledge management layer. There's no EPSS score, no CISA KEV listing, no public exploit code or Nuclei template, and exploitation requires an authenticated account — this is not an opportunistic internet-scanning risk, but it is trivial to trigger for anyone (or any compromised identity) already inside the instance. Patch to Open WebUI 0.11.1 or later, and in the interim audit which non-admin users hold write access to shared external knowledge bases. Monitor logs for unexpected DELETE calls to /api/v1/knowledge/{id}/delete correlating with sudden RAG retrieval failures across unrelated knowledge bases.

Sources: NVD GitHub Advisory CISA KEV ATLAS

What is the risk?

High CVSS (7.1) reflects low attack complexity, no user interaction, and network access, but real-world risk is tempered by the requirement for an already-authenticated low-privilege account with write access to an external knowledge base — this is an insider/compromised-credential threat model, not an unauthenticated internet-facing one. No EPSS score, no CISA KEV entry, no public PoC or scanner template exist, and there's no active exploitation signal. The impact is integrity/availability (shared config destruction, cascading unavailability), not confidentiality — data isn't exposed, but multi-user RAG functionality can be disrupted instance-wide by a single non-admin actor.

How does the attack unfold?

Initial Access

Attacker obtains or already holds an authenticated low-privilege account with write access to one external knowledge base in the Open WebUI instance.

AML.T0012

Exploitation

Attacker sends a DELETE request to /api/v1/knowledge/{id}/delete, which the API authorizes for the knowledge base but fails to separately gate the removal of its shared administrator-owned external connection.

AML.T0049

Impact

The shared connection configuration is destroyed, making every other knowledge base that depended on it unavailable instance-wide.

AML.T0029

Initial Access

Attacker obtains or already holds an authenticated low-privilege account with write access to one external knowledge base in the Open WebUI instance.

AML.T0012

Exploitation

Attacker sends a DELETE request to /api/v1/knowledge/{id}/delete, which the API authorizes for the knowledge base but fails to separately gate the removal of its shared administrator-owned external connection.

AML.T0049

Impact

The shared connection configuration is destroyed, making every other knowledge base that depended on it unavailable instance-wide.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	>= 0.10.0, < 0.11.1	`0.11.1`
151.8K 3 dependents Pushed 7d ago 83% patched ~5d to patch Full package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A Low

What should I do?

1 step

Upgrade to Open WebUI 0.11.1 or later immediately, which adds the missing administrator/dependency checks (see GHSA-2724-6cpj-gf3v and PR #28113). Until patched, restrict write access on external knowledge bases to trusted/admin-level users only, and avoid sharing a single external connection across knowledge bases owned by different low-privilege users. Audit existing knowledge base permissions for over-broad write grants. For detection, monitor application logs for DELETE requests to /api/v1/knowledge/{id}/delete originating from non-admin accounts, and alert on knowledge bases becoming unexpectedly unavailable shortly after such calls.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass DoS RAG API AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

Annex A.9 - AI system life cycle

OWASP LLM Top 10

LLM08:2025 - Vector and Embedding Weaknesses

Frequently Asked Questions

What is CVE-2026-87998?

A broken-access-control bug in Open WebUI's knowledge deletion endpoint lets any authenticated user with mere write access to one external knowledge base trigger deletion of the underlying, administrator-owned connection config — without a separate admin check or a check for other knowledge bases still depending on it. For a CISO, the concern isn't data theft (CVSS confidentiality impact is none) but availability and integrity: a low-privileged or compromised account can silently break RAG retrieval for every other team relying on that shared connection, a self-inflicted denial-of-service against your own knowledge management layer. There's no EPSS score, no CISA KEV listing, no public exploit code or Nuclei template, and exploitation requires an authenticated account — this is not an opportunistic internet-scanning risk, but it is trivial to trigger for anyone (or any compromised identity) already inside the instance. Patch to Open WebUI 0.11.1 or later, and in the interim audit which non-admin users hold write access to shared external knowledge bases. Monitor logs for unexpected DELETE calls to /api/v1/knowledge/{id}/delete correlating with sudden RAG retrieval failures across unrelated knowledge bases.

Is CVE-2026-87998 actively exploited?

No confirmed active exploitation of CVE-2026-87998 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-87998?

Upgrade to Open WebUI 0.11.1 or later immediately, which adds the missing administrator/dependency checks (see GHSA-2724-6cpj-gf3v and PR #28113). Until patched, restrict write access on external knowledge bases to trusted/admin-level users only, and avoid sharing a single external connection across knowledge bases owned by different low-privilege users. Audit existing knowledge base permissions for over-broad write grants. For detection, monitor application logs for DELETE requests to /api/v1/knowledge/{id}/delete originating from non-admin accounts, and alert on knowledge bases becoming unexpectedly unavailable shortly after such calls.

What systems are affected by CVE-2026-87998?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, knowledge management / knowledge bases, shared external data connectors.

What is the CVSS score for CVE-2026-87998?

CVE-2026-87998 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesknowledge management / knowledge basesshared external data connectors

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.9

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/knowledge/{id}/delete in backend/open_webui/routers/knowledge.py authorized deletion against the knowledge base but then removed its administrator-owned external connection without a separate administrator check or a check for other dependent knowledge bases. A non-administrator with write access to one external knowledge base could delete shared instance configuration and make every other knowledge base using that connection unavailable. This issue is fixed in version 0.11.1.

Exploitation Scenario

An employee or contractor with legitimate write access to one shared external knowledge base (e.g., a team wiki connector feeding a RAG pipeline) sends a DELETE request to /api/v1/knowledge/{id}/delete for that knowledge base. Because Open WebUI does not separately verify administrator privilege or check whether other knowledge bases still depend on the same external connection before tearing it down, the underlying shared connection configuration is destroyed instance-wide. Every other knowledge base built on that connection instantly loses retrieval capability, disrupting RAG-backed chat/search for unrelated teams — a low-effort, authenticated denial-of-service against the organization's AI knowledge infrastructure.

Weaknesses (CWE)

CWE-269 Improper Privilege Management Primary CWE-863 Incorrect Authorization Primary CWE-269 Improper Privilege Management CWE-863 Incorrect Authorization

CWE-269 — Improper Privilege Management: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Follow the principle of least privilege when assigning access rights to entities in a software system.

Source: MITRE CWE corpus.