MediumVulnerabilityLLM-specific
GHSA-57q6-fvp4-pqmm: Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints
- Identifiers
- CVE-2026-45339GHSA-57q6-fvp4-pqmm
- Published
- Record updated
- Affected
- open-webu <= 0.8.12
- Fixed in
- 0.9.0
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
Open WebUI's Anthropic-compatible API path accepts API keys via the `x-api-key` header, but endpoint restrictions are checked only for keys sent in the `Authorization` header. A key restricted from `/api/v1/messages` returns 403 with `Authorization: Bearer sk-...`, yet the same key sent via `x-api-key` is authenticated and returns a full model response. The advisory's proof of concept was verified against Open WebUI v0.8.11, and the bypass lets any restricted key reach any endpoint.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumExposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute IntrusionsSimilar attack · The Hacker News
- HighCVE-2026-57208: Entire CLI path traversal via SessionID in checkpoint restoreSimilar attack · NVD/CVE Database
- MediumInfostealer riding the AI TrainSimilar attack · Check Point Research
- HighCVE-2026-107685: req_llm WebSocket streaming client accepts untrusted TLS certificatesSimilar attack · NVD/CVE Database
- MediumGitLab critical patches include one for a bug that allows code execution by unauthenticated usersSimilar attack · CSO Online