Medium severity6.5NVD Advisory· Published Jun 23, 2026· Updated Jun 25, 2026
CVE-2026-54019
CVE-2026-54019
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI added collection-level ACL checks, but the patch can still be bypassed when Milvus multitenancy mode is enabled. The ACL allows unknown non-KB collection names as legacy/ephemeral collections. In Milvus multitenancy mode, that user-controlled collection name becomes a resource_id and is interpolated into a Milvus expression without escaping. This is caused by an incomplete fix for CVE-2026-44560 This vulnerability is fixed in 0.9.6.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
open-webuiPyPI | < 0.9.6 | 0.9.6 |
Affected products
3cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*range: <0.9.6
- (no CPE)range: =0.9.5
Patches
Vulnerability mechanics
References
5- github.com/open-webui/open-webui/security/advisories/GHSA-p5cp-r7rg-qpxcnvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-p5cp-r7rg-qpxcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-54019ghsaADVISORY
- github.com/pypa/advisory-database/tree/main/vulns/open-webui/PYSEC-2026-2750.yamlghsaWEB
- pypi.org/project/open-webuighsaWEB
News mentions
1- Open WebUI: 16 CVEs Disclosed in Single-Day Batch, Many Bypassing Earlier PatchesVypr Intelligence · Jun 17, 2026