AI Sec Watch

DeepSeek TUI's `run_tests` tool runs without user approval (it has `ApprovalRequirement::Auto`), which allows arbitrary code execution through test files and build scripts in a repository. An attacker can create a malicious repository with hidden commands in test code and an `AGENTS.md` file (prompt injection, where hidden instructions are placed in input meant for an AI) that tricks the AI model into running tests automatically on startup, executing the attacker's code with zero user confirmation.

DeepSeek's TUI has a security flaw in its `fetch_url` tool where it blocks direct requests to restricted IP addresses (like cloud metadata endpoints and private networks) but fails to re-check redirect targets. An attacker can bypass this SSRF protection (server-side request forgery, where an AI is tricked into accessing internal systems) by providing a public URL that redirects to a restricted IP, allowing potential theft of cloud credentials and sensitive data on cloud-hosted instances.

Open WebUI has a race condition (TOCTOU, or time-of-check-time-of-use, where a system checks a condition and then uses that information, but the condition can change in between) in its LDAP and OAuth login flows that allows multiple users to become administrators on a fresh installation. When the first user logs in via LDAP or OAuth, the system checks if the database is empty and assigns the admin role before creating the user account, but multiple concurrent login requests can all see an empty database and all become admins. The regular signup method was already fixed with a safer approach, but LDAP and OAuth were never updated with the same fix.

Any authenticated user can permanently delete files owned by other users in Open WebUI when those files are referenced in shared chats, because the authorization check (the code that verifies whether a user should be allowed to perform an action) ignores both the user's identity and the type of operation being requested. File IDs can be discovered by users with read access to knowledge bases (repositories of documents), making this vulnerability practical to exploit.

Open WebUI had an unauthenticated endpoint at GET `/api/v1/memories/ef` that triggered embedding generation (the process of converting text into numerical vectors for AI understanding), allowing anyone to make requests without logging in. An attacker could repeatedly call this endpoint to waste computing resources, rack up charges if a paid embedding service like OpenAI was configured, or degrade the service for legitimate users.

Open WebUI has a security flaw where authenticated users can access and modify other users' private files by exploiting two endpoints that don't properly check file ownership. In the first case, attackers can inject victim file IDs into their own folders to make the AI read private documents as context. In the second case, attackers can attach victim files to their own knowledge bases (collections of documents used for RAG, retrieval-augmented generation) to read and overwrite those files entirely.

Open WebUI has a vulnerability where the `_validate_collection_access()` function (a security check) only blocks access to collections with specific name prefixes, but knowledge bases use raw UUIDs (unique identifiers) as collection names, so the check skips them entirely. Any logged-in user who knows a private knowledge base's UUID can read its contents or inject fake data into it through the retrieval API endpoints, even though the knowledge API itself correctly blocks that access.

Open WebUI's `/api/v1/retrieval/` endpoint exposes RAG (retrieval-augmented generation, a technique where an AI pulls in external documents to answer questions) configuration details like embedding models and chunking parameters to anyone on the internet without requiring login credentials. An attacker can make a single HTTP request to discover the AI infrastructure setup and craft attacks that exploit how documents are split and retrieved.

Open WebUI has a security flaw where an internal-only parameter called `bypass_filter` is accidentally exposed through the HTTP query string on chat endpoints. Any authenticated user can append `?bypass_filter=true` to requests, which skips access control checks (the rules that prevent regular users from using admin-restricted models), allowing them to use models they shouldn't have permission to access.