CVE-2026-45667: Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)

May 14, 2026 (updated May 19, 2026)

GET /api/v1/memories/ef is accessible without authentication and executes request.app.state.EMBEDDING_FUNCTION(...). This allows any unauthenticated caller to trigger embedding generation which can lead to direct cost exposure if a paid provider is used. Code reference: backend/open_webui/routers/memories.py (@router.get("/ef") -> calls request.app.state.EMBEDDING_FUNCTION("hello world")).

References

github.com/advisories/GHSA-m69w-p7m4-585j
github.com/open-webui/open-webui/commit/e5035ea31e179977e805a7032c979ff59a71860a
github.com/open-webui/open-webui/releases/tag/v0.8.0
github.com/open-webui/open-webui/security/advisories/GHSA-m69w-p7m4-585j
nvd.nist.gov/vuln/detail/CVE-2026-45667

Code Behaviors & Features

Detect and mitigate CVE-2026-45667 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →