GHSA-m69w-p7m4-585j: Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)
- Identifiers
- CVE-2026-45667GHSA-m69w-p7m4-585j
- Published
- Record updated
- Affected
- open-webui <= 0.7.2
- Fixed in
- 0.8.0
- released February 12, 2026, 91 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
Open WebUI's GET /api/v1/memories/ef endpoint runs request.app.state.EMBEDDING_FUNCTION("hello world") without any authentication check, so unauthenticated callers can trigger embedding generation. Because repeated requests consume CPU or GPU resources and can generate charges on a paid remote embedding provider, the flaw enables cost exposure and denial of service.
Mitigation
Fixed in commit e5035ea31, first released in v0.8.0 (Feb 2026). The /api/v1/memories/ef route was removed entirely rather than given authentication, because it was a diagnostic endpoint with no legitimate caller. Users on >= 0.8.0 are not affected.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- open-webuiPyPILLM dependency since 2024-05-20
Related items
- HighCVE-2026-123356: GROBID unauthenticated thread exhaustion through /api/modelTraining endpointSimilar attack · NVD/CVE Database
- MediumCVE-2026-83494: training-operator immutability check bypass in PyTorchJob ValidateUpdate webhookSimilar attack · NVD/CVE Database
- CriticalCVE-2026-48705: MONAI PydicomReader affine computation accepts non-finite DICOM valuesSimilar attack · NVD/CVE Database
- LowCloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource ExhaustionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSimilar attack · Google Threat Intelligence