CVE-2026-0765
| CVE ID | CVE-2026-0765 |
| Vendor Disposition | Rejected, not a vulnerability |
| Published | 2026-01-23 |
| Issuing CNA | Zero Day Initiative (ZDI-26-031) |
| Claimed Severity | High (CVSS 8.8, CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) |
Timeline
This CVE has been withdrawn. The issuing CNA reviewed Open WebUI's analysis, agreed with its disposition, and set the record to REJECTED on 2026-09-02. The dispute is closed. The assessment below is the analysis the withdrawal rests on, kept published so that anyone still served this identifier by a downstream database can see why it no longer stands.
| Date | Event |
|---|---|
| 2025-10 | ZDI submits the underlying report through Open WebUI's security channel. Open WebUI closes it as out of scope and not a vulnerability under its published security policy, but does so without giving the reporter a written explanation at the time, which was a mistake on Open WebUI's part. |
| 2026-01-23 | ZDI publishes the CVE (ZDI-26-031). |
| 2026-05-04 | Open WebUI files a formal dispute with the CVE Program and notifies ZDI directly. Neither ZDI nor the CVE Program responds. |
| 2026-06-15 | Open WebUI files another dispute with the CVE Program; the Secretariat directs it to the issuing CNA (ZDI), which owns the record. The request is subsequently closed. |
| 2026-07-02 | With the CNA non-responsive, Open WebUI escalates the dispute a third time, to the CVE Program's Root / Top-Level Root under the CVE Record Dispute Policy (v2.0.0). |
| 2026-07-06 | Under the CVE Program's record-dispute procedure, the Program forwards the dispute to the issuing CNA (ZDI) for its determination. |
| 2026-07-08 | ZDI reviews Open WebUI's analysis and agrees with its disposition on this finding, and agrees to note the CVE as disputed/rejected with a reference to this page. |
| 2026-07-15 | Open WebUI follows up. The record still shows as PUBLISHED with no annotation. |
| 2026-07-21 | Open WebUI follows up again and asks the CVE Program to help bring the record to closure. ZDI replies the same day that it will respond and coordinate the record update later that week. |
| 2026-08-03 | Open WebUI follows up again. The record is unchanged. |
| 2026-08-08 | With no further movement from ZDI for over a month, Open WebUI returns to the CVE Program Root and asks it for closure. |
| 2026-08-14 | With no response to that request either, Open WebUI files a fresh request with the CVE Program for this record, asking it to carry out the update the CNA has already agreed to rather than reopening the dispute itself. |
| 2026-08-14 | The CVE Program follows up with the issuing CNA, asking whether it still intends to mark the record disputed or rejected. |
| 2026-08-18 | ZDI confirms it will update the record and reference this page in its advisory. |
| 2026-08-19 | ZDI asks what should change in the record. Open WebUI asks for the state set to REJECTED, a rejection reason naming the extension system as intended functionality, and this page referenced on the record itself. |
| 2026-09-02 | ZDI sets the record to REJECTED, recording the extension system being intended functionality as the reason and citing this page. |
The record now carries the REJECTED state at cve.org and at NVD, and its rejection reason states the basis and links to this page. Nothing further is outstanding with the issuing CNA or the CVE Program.
Downstream databases copy records at different times and some do not track state changes at all, so this identifier may still be presented as a live finding elsewhere. See Rejected CVEs in Vulnerability Databases for how to check any record yourself.
What the CVE Claims
The function install_frontmatter_requirements in backend/open_webui/utils/plugin.py allegedly allows a low-privileged authenticated remote attacker to execute arbitrary code by injecting malicious package names into the requirements field of a Tool's or Function's YAML frontmatter, which the function then passes to pip install via subprocess.check_call.
Why This Is Not a Vulnerability
install_frontmatter_requirements is the documented mechanism by which Open WebUI installs Python package dependencies declared in the YAML frontmatter of user-authored Tools and Functions. Tools and Functions are user-authored Python modules that the server loads, executes, and holds in memory. Authors declare pip dependencies via frontmatter, and the server resolves them on first load. This mirrors the dependency-declaration model of comparable extension systems (Jupyter notebooks with %pip install, n8n Code nodes, Home Assistant python_script).
There is no "injection" into a fixed pipeline. The user is not injecting commands into someone else's operation. They are submitting Python source code that includes a declared dependency list, and the server installs those dependencies and executes the code by design. The "attacker" in this scenario is a user exercising the code-execution rights they were explicitly granted.
Access Control
The function is reachable only through admin-gated routes (POST /api/v1/tools/create, POST /api/v1/tools/id/{id}/update, and analogous Function endpoints). These routes require either user.role == 'admin' or the workspace.tools permission, which is disabled by default for non-admin users. Granting workspace.tools is documented as equivalent to giving the user shell access to the server. There is no path by which an unprivileged user can reach this function.
Severity
Because this is intended behavior and not a vulnerability, no CVSS score applies to it; the published 8.8 (High) scores a capability the software is designed to provide. Separately, and only if the record is scored at all, the vector's PR:L (privileges required, low) is inaccurate: the function is reachable only by an administrator, or by a user an administrator has granted the root-equivalent workspace.tools permission, which is PR:H. This is recorded for completeness and does not bear on the disposition, which is out of scope on the intended-behavior basis regardless of severity.
Applicable Security Policy Rules
- Rule 10: Reports involving Tools or Functions, including code execution and frontmatter-based pip installation, are closed as intended behavior.
- Rule 9: "Pasting untrusted code into Functions/Tools" is explicitly cited as out-of-scope.
- Rule 1: Expected protocol behavior is not a vulnerability.
Impact to Users
No action required. This CVE describes intended functionality. If you have granted workspace.tools to untrusted users, review the Plugin Security documentation, but this is a configuration decision, not a vulnerability.