CVE-2026-87017

Executive Summary

CVE-2026-87017 is an information disclosure vulnerability in Open WebUI, an extensible, feature-rich, self-hosted AI platform. From version 0.7.0 until 0.11.1, the built-in knowledge search tool passed the caller's readable knowledge identifiers through a metadata filter, but the search methods in eleven shipped vector backends ignored that filter. An authenticated user on an affected backend could enumerate the identifiers, names, and descriptions of inaccessible knowledge bases from the shared collection—though the associated document text remained in separate collections—resulting in limited confidentiality impact scored at CVSS 4.3.

Technical Analysis

Open WebUI is a self-hosted AI platform that provides retrieval-augmented generation (RAG) capabilities through a "knowledge" feature. Knowledge bases are logical containers for documents that are used to ground model responses. Users can create, share, and query these knowledge bases, and the platform supports multiple interchangeable vector database backends for storing and searching embedded content.

The vulnerability resides in the interaction between two components:

1. The built-in knowledge search tool, which is responsible for querying knowledge bases. As documented in the NVD description, this tool "passed the caller's readable knowledge identifiers through a metadata filter." In other words, when a user performed a knowledge search, the tool constructed a query that included a constraint restricting results to only those knowledge bases the caller was authorized to read.

2. The search methods in eleven shipped vector backends, which "ignored that filter." The vector backends are the storage and retrieval engines (e.g., different supported vector database integrations) that actually execute the similarity search. While the search tool supplied the authorization constraint, these backends did not apply it when executing the query.

The result is an authorization bypass at the data-retrieval layer rather than at the application layer. The application intended to scope results to the caller's permitted knowledge bases, but the enforcement point was downstream of the application's policy decision and was not honored. Classification per CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) is consistent: the flaw exposes metadata about resources the user should not see.

The scope of disclosure is bounded by a key architectural detail stated in the description: "the associated document text remained in separate collections." This means the actual document content (the embedded chunks of user data) was not exposed through this flaw. What was exposed is metadata from the shared collection:

• Knowledge base identifiers
• Knowledge base names
• Knowledge base descriptions

This is consistent with the CVSS vector's C:L (Confidentiality: Low) rating—metadata leakage, not bulk content disclosure. The attack surface requires authentication (PR:L, Privileges Required: Low), network access (AV:N), and no user interaction (UI:N). Complexity is Low (AC:L) and the vulnerable component scope is Unchanged (S:U). There is no integrity (I:N) or availability (A:N) impact.

Notably, the vector count—"eleven shipped vector backends"—indicates this is not a single misconfiguration but a systemic gap across a majority of the platform's supported retrieval integrations. Because the filter was supplied by the caller to the backend but not enforced by it, the flaw likely originated from an inconsistent contract between the search tool and the backend interface (i.e., the tool assumed the backend would apply the metadata filter, while the backend implementations did not).

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-87017, and no Nuclei template or CISA KEV entry exists. The attack chain below is inferred strictly from the vulnerability class (CWE-200 authorization bypass / information exposure) and the specifics present in the NVD description. No function names, endpoints, or parameter names beyond those in the description are asserted.

1) Reconnaissance / Target Identification An attacker identifies an exposed Open WebUI instance—typically reachable at a web-accessible host serving the platform's interface. The attacker registers or is issued a low-privileged authenticated account. Open WebUI instances are commonly deployed internally or publicly for team use, so obtaining an authenticated session is often the only barrier. The attacker does not need knowledge of the vector backend in use; the flaw affects eleven shipped backends.

2) Triggering the Flaw The attacker invokes the platform's built-in knowledge search tool as an authenticated but low-privileged user. The search tool builds a query against the shared collection and passes the caller's readable knowledge identifiers as a metadata filter. Because the search methods in the affected vector backends ignore that filter, the backend returns results drawn from the full shared collection rather than only the caller's authorized subset.

3) Payload / Execution Method (vulnerability-class level) No malicious payload or code injection is required. The "payload" is simply a legitimate knowledge search request issued by an authenticated user. The abuse is semantic: the attacker relies on the backend's failure to honor the authorization filter that the search tool supplied. At the vulnerability-class level, this is a broken access control / authorization bypass where an intended filter is dropped by a downstream component. Enumerating results (e.g., by submitting broad or iterative search queries) can surface identifiers, names, and descriptions belonging to knowledge bases the attacker cannot read.

4) Post-Exploitation Impact The attacker gains visibility into the existence and naming of knowledge bases they are not authorized to access, including human-readable names and descriptions. Crucially, per the NVD description, the associated document text remained in separate collections and was not disclosed by this flaw. The primary post-exploitation value is therefore intelligence gathering: mapping the organization's internal knowledge structure, inferring sensitive project names or topic areas from knowledge base names and descriptions, and using that information to prioritize further, separate attacks. No lateral movement, code execution, or data modification results from this CVE alone.

Note: No public PoC exists; the above chain is derived from the described vulnerability mechanics and class.

Impact Assessment

CVSS 3.1: 4.3 (Medium) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

• AV:N (Network): Exploitable over the network; no local access required.
• AC:L (Low Complexity): No special conditions, race conditions, or unusual configurations are needed. The description states the flaw affects eleven shipped backends, indicating a deterministic, easily reproducible condition.
• PR:L (Low Privileges): Requires an authenticated account, but no elevated role. Any standard user on the platform qualifies.
• UI:N (No User Interaction): The attacker needs no action from a legitimate user or administrator.
• S:U (Unchanged): The confidentiality impact stays within the vulnerable component's security scope.
• C:L (Low Confidentiality): Only knowledge base identifiers, names, and descriptions are exposed—metadata, not document bodies. This is the ceiling that keeps the score in the Medium range.
• I:N / A:N: No integrity or availability impact.

Business Impact: Organizations running self-hosted Open WebUI deployments (commonly internal engineering, support, or research teams using RAG over proprietary data) may inadvertently leak the taxonomy of their proprietary knowledge bases. Knowledge base names and descriptions frequently reveal sensitive context—project codenames, customer identifiers, legal or HR topics—even without exposing the underlying documents. This is reconnaissance-grade intelligence that lowers the effort for follow-on attacks.

Blast Radius: All authenticated users of an affected instance. Because the gap spans eleven shipped vector backends, virtually any deployment in the affected version range (0.7.0 through 0.11.0) that uses the built-in knowledge search tool against a shared collection is potentially impacted. The exposure is limited to metadata in the shared collection; separate document-text collections are not affected by this specific flaw.

Detection Guidance

Caveat on detection content: The NVD description does not provide specific API endpoints, parameter names, function names, or request/response schemas. The rules below are therefore written against behavioral and generic signatures (HTTP request patterns to Open WebUI, knowledge-search activity, and metadata-filter-missing indicators). Analysts should validate and tune these against their own deployment telemetry and should treat field names as illustrative pattern matches, not confirmed identifiers.

Sigma Rule

title: Open WebUI Knowledge Metadata Enumeration (CVE-2026-87017)
id: 3f9c2e14-7b6a-4d2e-9c1a-870170000001
status: experimental
description: Detects authenticated Open WebUI knowledge search activity consistent with metadata enumeration when backend search ignores the readable-knowledge metadata filter (CVE-2026-87017).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87017
author: valtersit.com Threat Intelligence
date: 2026-01-01
logsource:
  category: web
  product: open_webui
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/api/v1/knowledge'
      - '/retrieval'
      - '/query'
  selection_search:
    cs-uri-query|contains:
      - 'search'
      - 'query'
      - 'collection'
  filter_legit_bulk:
    cs-uri-query|contains:
      - 'page='
  condition: selection_path and selection_search and not filter_legit_bulk
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate knowledge search by authorized users
  - Administrative bulk operations
level: medium
tags:
  - attack.t1213
  - cve.2026.87017

YARA Rule

rule CVE_2026_87017_OpenWebUI_Knowledge_Metadata_Enumeration
{
    meta:
        description = "Detects Open WebUI artifacts/logs referencing knowledge metadata enumeration tied to CVE-2026-87017"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87017"
        date = "2026-01-01"
        cve = "CVE-2026-87017"

    strings:
        $a = "knowledge_id" ascii nocase
        $b = "readable" ascii nocase
        $c = "metadata" ascii nocase
        $d = "vector" ascii nocase
        $e = "search" ascii nocase
        $f = "Open WebUI" ascii nocase
        $g = "/api/v1/knowledge" ascii nocase

    condition:
        uint16(0) == 0x7B7B or
        ( 3 of ($a,$b,$c,$d,$e,$f) and $g )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87017 Open WebUI Knowledge Metadata Enumeration Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/v1/knowledge"; nocase; http.uri; content:"search"; nocase; classtype:attempted-recon; reference:cve,2026-87017; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87017; sid:8701701; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ network where url.path : ("/api/v1/knowledge*" or "*/retrieval*" or "*/query*")
      and url.query : ("*search*" or "*query*" or "*collection*") ]
  [ network where url.path : ("/api/v1/knowledge*" or "*/retrieval*" or "*/query*")
      and url.query : ("*search*" or "*query*" or "*collection*") ]

EQL sequence signals repeated knowledge-search requests by the same user/IP within a short window—consistent with an enumeration pattern where an authenticated caller exploits the missing metadata filter to harvest inaccessible knowledge identifiers, names, and descriptions.

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path IN ("/api/v1/knowledge*", "*retrieval*", "*query*") uri_query IN ("*search*","*query*","*collection*")
| stats count AS requests dc(uri_query) AS distinct_queries values(uri_path) AS paths BY src_ip, user
| where requests > 20 AND distinct_queries > 5
| sort - requests

Wazuh OSSEC Rule

<group name="openwebui,cve-2026-87017,">
  <rule id="870171" level="6">
    <decoded_as>web-accesslog</decoded_as>
    <url>/api/v1/knowledge</url>
    <description>CVE-2026-87017: Open WebUI knowledge search request (potential metadata enumeration - missing readable-knowledge filter)</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>

  <rule id="870172" level="10" frequency="20" timeframe="300">
    <if_matched_sid>870171</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-87017: Repeated Open WebUI knowledge search from same source - likely metadata enumeration of inaccessible knowledge bases</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence is available from any tracked source; no vendor advisory link, commit hash, or fixed-version artifact was supplied. The NVD description states the issue is "fixed in version 0.11.1," but this has not been corroborated by any tracked patch source. Treat the environment as unpatched until the fix is independently verified in your deployment.

1) Immediate Mitigations (interim, until upgrade is validated):

• Restrict network exposure of Open WebUI instances to trusted networks/VPN; avoid direct public exposure.
• Limit creation of low-privileged accounts to vetted, trusted personnel.
• If the vector backend is configurable, evaluate whether a backend that does honor the metadata filter can be selected; the description indicates eleven backends ignored the filter, so this requires testing per-backend.
• Monitor and rate-limit repeated knowledge-search requests per authenticated user (see Detection Guidance).
• Where feasible, disable the built-in knowledge search tool for untrusted users until the fix is verified.

2) Patch / Upgrade Steps:

• Upgrade Open WebUI to 0.11.1 or later, which the NVD description identifies as the fixing release.
• Because no vendor advisory or commit hash is available in tracked sources, verify the upgrade using an independent source (vendor GitHub release notes) before relying on it. Confirm the fix explicitly applies the readable-knowledge metadata filter in the affected vector backend search methods.
• Test in a staging environment first; validate that cross-knowledge-base metadata is no longer returned to unauthorized users.

3) Long-Term Hardening:

• Enforce authorization at the data layer (the vector backend) rather than relying solely on filters passed from the application layer. Authorization decisions should be validated at the point of execution, not assumed downstream.
• Adopt defense-in-depth: server-side authorization checks on every retrieval path, not just the search tool entry point.
• Audit all vector backend integrations against a consistent authorization contract; the "eleven backends" scope suggests a recurring interface-consistency problem.
• Maintain a patching SLA for self-hosted AI platforms and monitor CVE feeds for this product.

References

1. NVD — CVE-2026-87017: https://nvd.nist.gov/vuln/detail/CVE-2026-87017
2. CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
3. MITRE ATT&CK — T1213 Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
4. Open WebUI project (vendor release notes for 0.11.1 to be independently verified): https://github.com/open-webui/open-webui

Threat actor / exploitation status: No CISA KEV entry, no public PoC, no exploit code, and no Nuclei template is associated with CVE-2026-87017 as of this report. EPSS has not yet scored this CVE; no EPSS value is asserted. No known threat actor campaigns or in-the-wild exploitation evidence were identified in the provided data.