CVE-2026-45672: Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed
The /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes.
What it is
The /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes.
The admin configuration correctly shows ENABLE_CODE_EXECUTION: false. However, the code execution endpoint does not check this flag before forwarding Python code to the Jupyter server. Any authenticated user can execute arbitrary code in the Jupyter container.
Verified against Open WebUI v0.8.11 (latest) Docker on 2026-03-25.
How to check
- Affected: open-webui (pip) <= 0.8.11.
- Compare your installed version with the range above (command below).
How to fix
- Upgrade open-webui to 0.8.12 or later.
pip show open-webui | grep VersionSources
- highCVE-2026-109572: Open WebUI terminal proxy lets regular users act as Terminals admin
- highCVE-2026-87995: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
- highCVE-2026-87016: Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
- highCVE-2026-70492: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages