Threat Intelligence Report — CVE-2026-87998

Executive Summary

CVE-2026-87998 is an improper authorization / privilege-context flaw (CWE-269) in Open WebUI, a self-hosted AI platform, affecting versions 0.10.0 through 0.11.0. A non-administrator user with write access to a single external knowledge base can invoke the knowledge-base deletion endpoint and cause the platform to remove an administrator-owned external connection, because the deletion logic authorizes the knowledge-base action but does not perform an independent administrator check or verify whether other knowledge bases depend on that connection. The result is a denial of service against every other knowledge base sharing the connection, with a CVSS v3.1 base score of 7.1 (High).

Technical Analysis

Open WebUI exposes a REST API, including a knowledge-base management router implemented at backend/open_webui/routers/knowledge.py. The affected endpoint is DELETE /api/v1/knowledge/{id}/delete.

The vulnerability is an authorization-context / privilege-boundary defect (CWE-269 — Improper Privilege Management). The NVD description states that the endpoint "authorized deletion against the knowledge base but then removed its administrator-owned external connection without a separate administrator check or a check for other dependent knowledge bases."

This describes a two-stage operation with mismatched authorization scopes:

1. Authorization stage — knowledge base: The request is authorized against the target knowledge base. A non-administrator possessing write access to that knowledge base passes this check because the action they are performing (deleting the knowledge base) is within the scope of their granted permissions.

2. Privileged operation stage — external connection: As a side effect of the deletion, the code path removes an external connection object that is owned and configured by an administrator. This operation is not re-authorized against an administrator role, and it is not validated against referential integrity — no check is performed to determine whether other knowledge bases depend on the same external connection.

The security boundary being crossed is the administrative ownership of shared instance configuration. The attacker does not need to escalate to an administrator account; they only need the pre-existing, legitimately granted privilege of write access to one knowledge base. That makes this a classic "authorization only on the first leg of a multi-leg operation" bug.

Two control failures compound each other:

• Missing role re-check: The removal of an administrator-owned resource is executed without an is_admin-style gate. The operation inherits the authorization decision made for the (lower-privileged) knowledge-base deletion.
• Missing dependency/referential-integrity check: The code does not confirm whether any other knowledge bases reference the external connection before deleting it. There is no guard against cascading breakage.

Because the deletion target is a shared external connection, the impact is not confined to the knowledge base the attacker controls. It propagates to every other knowledge base bound to that connection. This is why the Confidentiality impact is None (C:N, no data disclosure), Integrity impact is High (I:H, shared configuration is destroyed or broken), and Availability impact is Low (A:L) — limited to the knowledge bases dependent on the affected connection rather than the entire instance.

The attack is network-reachable (AV:N), requires low complexity (AC:L), requires an authenticated low-privilege session (PR:L), and requires no user interaction (UI:N). These subscores combine to the published CVSS v3.1 score of 7.1 (High).

No public proof-of-concept, exploit code, or Nuclei template is available as of this report. The mechanism is nonetheless straightforward to test by any authenticated low-privilege user, which lowers the barrier to independent reproduction. Notably, the API route uses an explicit /delete suffix on a DELETE method — an unusual pattern that is easy to fingerprint in logs and by scanners.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the endpoint and behavior described by the CNA. No function names, parameters, or code paths beyond those stated in the description are assumed.

1) Reconnaissance / target identification. An adversary identifies a reachable Open WebUI deployment (self-hosted AI platforms are frequently internet-exposed or reachable on internal networks). The attacker registers an account or authenticates with existing low-privilege credentials and enumerates knowledge bases to locate one to which they hold write access, and to identify the external connection(s) bound to it. Deployments are fingerprinted by the API surface, including the knowledge router and the /api/v1/knowledge/{id}/delete route pattern.

2) Triggering the flaw class. The attacker issues DELETE /api/v1/knowledge/{id}/delete against a knowledge base they are permitted to modify. The endpoint authorizes the knowledge-base deletion against the caller's rights on that knowledge base — the check that should be sufficient for the base action — and then proceeds to remove the associated administrator-owned external connection.

3) Execution / authorization bypass. No payload, injection string, or malformed request is required. The bypass is a pure authorization-context defect: because the endpoint omits a separate administrator check on the connection-removal step, the attacker's legitimate low-privilege write access is sufficient to cause a privileged state change. In effect, a per-resource permission is leveraged to modify instance-level configuration owned by an administrator.

4) Post-exploitation impact. The external connection is deleted. Because no dependency check precedes the deletion, every other knowledge base that relies on the same connection loses it and becomes unavailable. The attacker has caused a shared-configuration integrity loss and an availability outage across tenant knowledge bases — without ever obtaining administrator credentials. There is no evidence in the description of data disclosure; the damage is destruction of shared configuration and the resulting denial of service.

The primary constraints on the attacker are: (a) they must possess a valid account, and (b) they must have write access to at least one knowledge base bound to a shared external connection. Both are low bars in multi-user or multi-tenant deployments where knowledge-base sharing is common.

Impact Assessment

Direct impact. A single low-privileged, authenticated action removes administrator-owned external connection configuration. All other knowledge bases bound to that connection become unavailable. This is an availability and integrity event, not a confidentiality event.

CVSS v3.1 subscores (base 7.1, High):

Blast radius. Impact scales with the number of knowledge bases sharing the administrator-owned external connection. In a single-tenant, single-connection deployment the effect may be limited; in a multi-tenant or departmental deployment where one connection is shared broadly, a single attacker action can degrade or disable many knowledge bases simultaneously. The I:H/S:U combination reflects that the attacker modifies the state of the same security authority (the Open WebUI instance) that issued their privileges.

Affected systems. Self-hosted Open WebUI instances running versions 0.10.0 through 0.11.0 that (a) have more than one user with write access to knowledge bases and (b) use shared external connections across knowledge bases. Internet-exposed instances carry the highest exposure; internal deployments with untrusted or numerous users are also in scope.

Business impact. Loss of shared integration/connection configuration forces administrator reconfiguration and restoration from backup; dependent knowledge bases and any RAG or retrieval pipelines built on them become unavailable during the outage. Because the action is performed through a legitimate, correctly authenticated request, it may not raise the same alarms as an obvious injection or RCE attempt.

Threat context. CVSS 7.1, CWE-269, not in CISA KEV, no known in-the-wild exploitation, no public PoC, and no Nuclei template as of this report. EPSS has not yet been scored by FIRST.org and must not be assumed. The low skill floor and high-value target profile (an AI platform) warrant treating this as an actionable insider/multi-tenant risk even absent public exploit code.

Detection Guidance

Detection focuses on the abuse of DELETE /api/v1/knowledge/{id}/delete and the resulting loss of external connection state. Because the request itself is legitimate-looking, correlation between deletion events and the identity/role of the caller is essential. Log-based detections should key on the knowledge router and on non-administrator actors performing deletions that precipitate connection-removal or dependent-knowledge-base errors.

Sigma Rule

title: Open WebUI External Connection Deletion via Knowledge Base Delete
id: 8f2c1b44-9a3e-4d21-b7c0-3e5a9f1c8799
status: experimental
description: Detects non-administrator DELETE /api/v1/knowledge/{id}/delete requests that may remove a shared administrator-owned external connection in Open WebUI (CVE-2026-87998).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87998
author: Valters IT Threat Intelligence
date: 2026-01-01
logsource:
  product: open_webui
  service: http
detection:
  selection_endpoint:
    http.request.method: 'DELETE'
    url.path|contains: '/api/v1/knowledge/'
    url.path|endswith: '/delete'
  selection_status:
    http.response.status_code:
      - 200
      - 204
  filter_admin:
    user.roles|contains: 'admin'
  condition: selection_endpoint and selection_status and not filter_admin
fields:
  - user.id
  - user.roles
  - url.path
  - http.response.status_code
  - source.ip
falsepositives:
  - Legitimate deletions performed by custom administrative roles not labeled 'admin'
level: medium
tags:
  - attack.t1190
  - cve.2026-87998

YARA Rule

rule CVE_2026_87998_OpenWebUI_Knowledge_Delete_Handler
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Identifies the Open WebUI knowledge router source handling the vulnerable DELETE /api/v1/knowledge/{id}/delete path (CVE-2026-87998)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87998"
        date = "2026-01-01"
        severity = "high"

    strings:
        $route = "/api/v1/knowledge/" ascii wide
        $path  = "routers/knowledge.py" ascii wide
        $del   = "/delete" ascii wide
        $kb    = "knowledge" ascii wide nocase
        $conn  = "connection" ascii wide nocase

    condition:
        filesize < 2MB and
        ( $path or ( $route and $del ) ) and
        $kb and $conn
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87998 Open WebUI Knowledge Base Delete Endpoint Access"; flow:established,to_server; http.method; content:"DELETE"; http.uri; content:"/api/v1/knowledge/"; http.uri; content:"/delete"; distance:0; within:64; classtype:attempted-user; reference:cve,2026-87998; sid:202687998; rev:1; metadata:affected_product Open_WebUI, attack_target Server, deployment Perimeter, signature_severity Minor, created_at 2026_01_01, cve CVE_2026_87998;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ network where http.request.method == "DELETE" and
      url.path : "/api/v1/knowledge/*" and url.path : "*/delete" and
      not user.roles : "admin" ]
  [ network where http.response.status_code : (200 or 204) and
      /* dependent knowledge base or connection failure surfaces after deletion */
      ( error.message : "*connection*" or error.message : "*unavailable*" or
        http.response.status_code : (500 or 502 or 503) ) ]

Splunk SPL Query

(index=web OR index=open_webui) sourcetype=http:access
| search uri_path="/api/v1/knowledge/*/delete" method=DELETE
| eval actor=coalesce(user, user_name, "unknown")
| eval actor_role=coalesce(role, roles, "unknown")
| where NOT match(actor_role, "(?i)admin")
| stats count AS delete_attempts, values(uri_path) AS paths, values(status) AS statuses BY actor, src_ip
| where delete_attempts > 0
| sort - delete_attempts
| table actor actor_role src_ip delete_attempts statuses paths

Wazuh OSSEC Rule

<group name="open_webui,web,cve_2026_87998,">
  <rule id="879980" level="8">
    <decoded_as>json</decoded_as>
    <field name="http.request.method">DELETE</field>
    <field name="url.path" type="pcre2">^/api/v1/knowledge/[^/]+/delete$</field>
    <description>CVE-2026-87998: Open WebUI knowledge base delete request observed (possible shared external connection removal)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="879981" level="12">
    <if_sid>879980</if_sid>
    <field name="user.roles" negate="yes" type="pcre2">(?i)admin</field>
    <description>CVE-2026-87998: Non-administrator performed Open WebUI knowledge base deletion - potential privileged connection removal</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED). No patch evidence is available from any tracked source. The CNA states the issue is fixed in Open WebUI 0.11.1, but no advisory, commit, or package version has been corroborated by the tracked patch sources. Treat the following as interim guidance and verify directly against the upstream project before relying on any specific release.

1) Immediate mitigations (no code change required):

• Restrict access to the knowledge router. Where feasible, place Open WebUI behind an authenticating reverse proxy and restrict write access to knowledge bases to trusted users only. Removing write access from untrusted accounts removes the precondition for exploitation.
• Enforce least privilege on knowledge bases. Audit which accounts hold write access to knowledge bases bound to shared external connections; reduce that set to the minimum.
• Make the required action require an administrator. Although the code cannot be changed, monitor and restrict the anomalous /delete-suffixed route externally via WAF/reverse-proxy rules so that calls from non-administrator sessions are logged, alerted, or blocked.
• Segment connections. Reduce the blast radius by avoiding a single external connection shared across many knowledge bases, so that removal of one connection cannot cascade.
• Back up connection configuration. Maintain recent, restorable backups of external connection settings to shorten recovery time from an integrity-loss event.
• Network exposure. Avoid exposing Open WebUI directly to the public internet; require VPN or authenticated access.

2) Patch / upgrade steps:

• Upgrade to Open WebUI 0.11.1 or later, per the CNA, to obtain the fix. Because patch confidence is 0/4, verify the fixed version directly from the upstream project's release notes and confirm the endpoint now performs an administrator check and a dependent-knowledge-base check before removing the external connection.
• After upgrading, re-validate any connections that may have been deleted, and confirm restored knowledge-base availability.

3) Long-term hardening:

• Re-authorize at each privileged step. Multi-stage operations that cross security boundaries must re-check authorization for each privileged sub-operation rather than inheriting the first-leg decision. Removing administrator-owned resources should always require an explicit administrator gate.
• Enforce referential integrity. Deletion of a shared resource must check for dependent objects and fail safe (block, warn, or cascade with approval) rather than silently removing the shared dependency.
• Track authorization changes in Open WebUI and other AI platforms as a standing review item, since AI platforms increasingly hold sensitive configuration and shared integrations.
• Adopt structured, role-aware logging so that non-administrator actions producing instance-level side effects are always visible to the SOC.
• Because this CVE is not in CISA KEV and no EPSS score is yet published, do not rely on exploit-based prioritization alone — prioritize on exposure, tenant count, and the trust level of the user base.

References

1. NVD — CVE-2026-87998: https://nvd.nist.gov/vuln/detail/CVE-2026-87998
2. CWE-269 — Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html
3. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. Open WebUI project repository (knowledge router /api/v1/knowledge/{id}/delete and release 0.11.1): https://github.com/open-webui/open-webui
5. FIRST.org EPSS (no score published for this CVE as of this report): https://www.first.org/epss/

Exploit-in-the-wild / threat actor evidence: None observed. Not listed in CISA KEV; no public PoC, exploit code, or Nuclei template identified. No known threat actor campaigns are associated with CVE-2026-87998 at this time.

Report generated for valtersit.com. Patch confidence is low (0/4); validate the vendor fix version upstream before relying on it. EPSS value intentionally omitted (not scored).