6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54019

CVE-2026-54019: Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI added collection-level ACL checks, but the patch can still be bypassed when Milvus multitenancy mode is enabled. The ACL allows unknown non-KB collection names as legacy/ephemeral collections. In Milvus multitenancy mode, that user-controlled collection name becomes a resource_id and is interpolated into a Milvus expression without escaping. This is caused by an incomplete fix for CVE-2026-44560 This vulnerability is fixed in 0.9.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54019

CVE-2026-54019:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
open-webui	pip	<= 0.9.5	0.9.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic case of an injection attack, specifically targeting the Milvus vector database when used in multitenancy mode. The analysis of the patch clearly shows a two-level fix. The primary vulnerability lies in the filter_accessible_collections function, which failed to sanitize the input collection_names, acting as the entry point for the malicious payload. The secondary vulnerability is in the MilvusClient class, where the search and query methods directly interpolated the unsanitized collection name into a database filter expression, executing the injected payload. The patch addresses both issues: it adds strict validation of collection names in filter_accessible_collections and, as a defense-in-depth measure, adds validation and escaping within the MilvusClient methods. Therefore, these three functions are identified as the vulnerable functions that would appear in a runtime profile during exploitation.

Vulnerable functions

filter_accessible_collections

backend/open_webui/retrieval/utils.py

This function was responsible for access control on collections. It incorrectly allowed any unknown collection name to pass as valid, without checking for malicious characters. This allowed an attacker to pass a crafted collection name with an injected query payload to the underlying database.

MilvusClient.search

backend/open_webui/retrieval/vector/dbs/milvus_multitenancy.py

This function constructs a database query expression for Milvus DB. It used the user-provided collection name (`resource_id`) directly in the expression without validation or escaping, making it vulnerable to an injection attack. A crafted collection name could alter the query logic to bypass access controls.

MilvusClient.query

backend/open_webui/retrieval/vector/dbs/milvus_multitenancy.py

Similar to the `search` method, this function constructs a database query expression using the user-provided collection name (`resource_id`) without proper validation or escaping. This created an injection vulnerability, allowing an attacker to manipulate the query and access unauthorized data.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.