{"data":{"id":"2f99c8fe-d244-4acc-9e9d-169f8b8e38f2","title":"GHSA-m69w-p7m4-585j: Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)","summary":"Open WebUI's GET /api/v1/memories/ef endpoint runs request.app.state.EMBEDDING_FUNCTION(\"hello world\") without any authentication check, so unauthenticated callers can trigger embedding generation. Because repeated requests consume CPU or GPU resources and can generate charges on a paid remote embedding provider, the flaw enables cost exposure and denial of service.","solution":"Fixed in commit e5035ea31, first released in v0.8.0 (Feb 2026). The /api/v1/memories/ef route was removed entirely rather than given authentication, because it was a diagnostic endpoint with no legitimate caller. Users on >= 0.8.0 are not affected.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-m69w-p7m4-585j","publishedAt":"2026-05-14T20:28:02.000Z","cveId":"CVE-2026-45667","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["open-webui@<= 0.7.2 (fixed: 0.8.0)"],"affectedPackageNames":["open-webui"],"affectedPackageRefs":["pypi:open-webui"],"affectedVendors":[],"affectedVendorsRaw":["Open WebUI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00341,"epssCheckedAt":"2026-11-07T00:12:13.235Z","kevDateAdded":null,"advisoryAliases":["GHSA-m69w-p7m4-585j"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-14T20:28:02.000Z","fixReleasedAt":"2026-02-12T23:48:04.099Z","daysToFix":-91,"fixCheckedAt":"2026-10-29T21:36:06.309Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"open-webui","fixedVersion":"0.8.0","matchedVersion":"0.8.0","fixReleasedAt":"2026-02-12T23:48:04.099Z","daysToFix":-91,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:36:06.163Z"}]}}