ACL Bypass in Open WebUI via Milvus Multitenancy

Compliance Impact

This vulnerability allows an authenticated low-privilege user to bypass access control lists (ACLs) and read private knowledge-base content belonging to other users without requiring victim interaction.

Such unauthorized access to private data can lead to violations of data protection regulations and standards like GDPR and HIPAA, which mandate strict controls on access to personal and sensitive information.

Therefore, if exploited in a production environment using Milvus multitenancy mode, this vulnerability could compromise compliance by exposing private user data to unauthorized parties.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-54019 is a vulnerability in Open WebUI versions 0.9.5 and earlier when used with Milvus multitenancy mode enabled. It allows an authenticated low-privilege user to bypass access control lists (ACLs) and read private knowledge-base content belonging to other users without their interaction.

The root cause is that Open WebUI permits unknown collection names as legacy or ephemeral collections, and Milvus multitenancy mode treats these user-controlled collection names as resource IDs without proper validation or escaping. This allows an attacker to craft malicious collection names that bypass ACL checks and get interpolated into Milvus query expressions, resulting in unauthorized data access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an authenticated low-privilege user to access private retrieval-augmented generation (RAG) or knowledge-base content belonging to other users without permission.

Such unauthorized access can lead to exposure of sensitive or confidential information stored in private collections, potentially compromising data confidentiality and trust in the system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your Open WebUI deployment is running version 0.9.5 or earlier with Milvus multitenancy mode enabled. Specifically, detection involves verifying whether unknown or user-controlled collection names are accepted and used as resource IDs without proper escaping in Milvus query expressions.

One way to detect exploitation attempts is to monitor for suspicious collection names containing special characters or crafted payloads such as "x' or resource_id != '' or resource_id == 'x" which are designed to bypass ACL checks.

While no explicit commands are provided in the resources, you can audit logs or query parameters for collection names with quotes or control characters and test your system by attempting to create or query collections with such names to see if unauthorized data is accessible.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading Open WebUI to version 0.9.6 or later, where this vulnerability is fixed.

Additionally, you should prevent arbitrary unknown collection names in user-controlled RAG query endpoints by rejecting collection names containing quotes or control characters unless they match known internal formats.

Ensure that Milvus expression values are properly escaped or parameterized to avoid injection of malicious queries.

Finally, add regression tests for this payload in your Milvus multitenancy mode environment to verify that the ACL bypass cannot be reproduced.

Useful 0 Not Useful 0