CVE-2026-54016: Open WebUI BOLA Vulnerability in Knowledge Base Search (0.9.6 Patch)

Technical summary

CVE-2026-54016 is a Broken Object Level Authorization (BOLA) vulnerability affecting Open WebUI's builtin search_knowledge_files tool. The flaw exists in versions prior to 0.9.6 when native function calling is enabled. An authenticated attacker can invoke search_knowledge_files with an arbitrary knowledge_id parameter. The function returns file metadata (names, identifiers, timestamps) from the specified knowledge base without verifying the caller's read permissions. The vulnerability manifests only when the selected model has no attached knowledge bases, suggesting the authorization check is either skipped or incorrectly scoped under this condition. The issue aligns with CWE-639 (Authorization Bypass Through User-Controlled Key).

Business impact

The exposure is primarily informational: attackers can enumerate the structure and naming conventions of private or restricted knowledge bases within an organization's self-hosted Open WebUI instance. This reconnaissance may reveal sensitive topics, document categories, or naming patterns that inform further social engineering or targeted attacks. Because file content is not directly accessible via this vector, confidentiality impact is limited to metadata. However, in environments storing knowledge bases with names or structures tied to confidential projects, financial data, or intellectual property, this leakage could be material. The fix is straightforward; risk is not mitigated by network isolation alone if the attacker is already authenticated.

Affected systems

Open WebUI prior to version 0.9.6 is affected. The vulnerability requires three conditions: (1) Open WebUI must be running version 0.9.6 or earlier, (2) native function calling must be enabled in the deployment, and (3) the user's selected model must have no attached knowledge bases. Self-hosted instances are the primary target, as Open WebUI is designed for offline operation. Cloud-hosted or managed deployments depend on the operator's configuration choices.

Exploitability

Exploitability is moderate. The attack requires an authenticated user account with access to the Open WebUI interface and function-calling enabled; unauthenticated attackers cannot trigger the vulnerability. The barrier to exploitation is low once inside: an attacker need only craft requests with different knowledge_id values to enumerate files. No special tooling is required beyond access to the chat or function-calling interface. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects this profile: network-accessible, low attack complexity, requires low privilege (authenticated user), low confidentiality impact, no integrity or availability impact.

Remediation

Upgrade Open WebUI to version 0.9.6 or later. The patch implements proper authorization checks in the search_knowledge_files function to ensure callers only retrieve file metadata from knowledge bases they are explicitly permitted to access. Organizations should verify the upgrade path in their deployment model (Docker, package manager, source build) and test in a staging environment before rolling out to production.

Patch guidance

Deploy version 0.9.6 of Open WebUI or any subsequent release. Verify the version in your running instance via the admin dashboard or by checking the package version in your deployment method. If upgrading is delayed, temporarily disable native function calling in model configurations or restrict knowledge base access policies until the update can be applied. Test the patched version against your existing knowledge bases to confirm backward compatibility.

Detection guidance

Monitor Open WebUI logs for calls to search_knowledge_files with knowledge_id parameters that do not match models' attached knowledge bases. Implement audit logging for function-calling invocations and cross-reference the calling user's permissions against the knowledge_id being queried. Alert on repeated calls to search_knowledge_files with different knowledge_id values by a single user, which may indicate enumeration. Check access logs for calls originating from unexpected IP addresses or users with low privilege.

Why prioritize this

Although the CVSS score is 4.3 (MEDIUM), prioritization should account for organizational sensitivity to information disclosure. If your knowledge bases contain strategic information, naming conventions tied to confidential projects, or structural intelligence about internal operations, the impact may warrant earlier patching. Additionally, CVE-2026-54016 does not appear on the CISA KEV catalog, suggesting empirical exploitation is not yet widespread; early patching reduces risk before active weaponization. For general deployments, scheduling the upgrade within a routine maintenance window is appropriate.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible vulnerability requiring authentication (PR:L) with only confidentiality impact via metadata leakage (C:L). No integrity, availability, or privilege escalation occurs. The attack complexity is low (AC:L), and no user interaction is needed (UI:N). The score appropriately de-emphasizes the risk because the attacker must be a legitimate user and cannot access sensitive content directly—only file names and structural metadata. Organizations handling highly sensitive or proprietary knowledge bases may treat the practical risk as higher than the numerical score suggests.

Frequently asked questions