CVE-2026-44551
CriticalOpen WebUI has an LDAP Empty Password Authentication Bypass
Published May 8, 2026 · Updated Aug 12, 2026 · Also known as GHSA-2r4p-jpmg-48f4, PYSEC-2026-435
Key Facts
Patch in the next maintenance window- CVE-2026-44551 is a critical-severity vulnerability (CVSS 9.1 v3.1) affecting Open Webui (Openwebui).
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 1.6% probability of exploitation in the next 30 days.
- Fixed versions are available, including Open Webui 0.9.0.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
CVSS v3.1
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS (30-day exploit likelihood)
1.6%
Higher than 75.8% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2026-44551 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accepts password: str with no minimum length constraint, so an empty string passes validation.
The subsequent Connection.bind() call succeeds on vulnerable LDAP servers, and the application issues a full session token for the target user. This vulnerability is fixed in 0.9.0.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Open WebuiOpenwebui | >= < 0.9.0 | 0.9.0 |
Patched Releases
Open Webui
0.9.0
Timeline
Publicly disclosed
May 8, 2026
Last updated
Aug 12, 2026
Weakness Type
- CWE-287 Improper Authentication
References
- advisoryGHSA advisory
- advisorycve.org · CVERecord
- advisorynvd.nist.gov · CVE-2026-44551
- articlehttps://github.com/open-webui/open-webui/security/advisories/GHSA-2r4p-jpmg-48f4
- othergithub.com · open-webui
FAQ
Common Questions.
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.
Affected: Open Webui (Openwebui) versions >= < 0.9.0. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Open Webui 0.9.0.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2026-44551 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo