PT-2026-59354 · Pypi · Open-Webui

Published

2026-07-13

·

Updated

2026-07-13

CVSS v3.1

8.1

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite

Affected Component

Retrieval web/YouTube processing endpoints:
  • backend/open webui/routers/retrieval.py (lines 1810-1837, process web)
  • backend/open webui/routers/retrieval.py (the parallel process youtube endpoint)
  • backend/open webui/routers/retrieval.py (line 1445, save docs to vector db call chain)

Affected Versions

Current main branch (commit 6fdd19bf1) and likely all versions with RAG/knowledge base functionality.

Description

The POST /api/v1/retrieval/process/web endpoint accepts a user-supplied collection name and an overwrite query parameter (default: True). It performs no authorization check on whether the calling user owns or has write access to the target collection. When overwrite=True, save docs to vector db calls VECTOR DB CLIENT.delete collection() on the target collection before writing new content.
Combined with the knowledge base enumeration vulnerability (separate report), an attacker can trivially discover any user's knowledge base UUID and then destroy or poison it.
python
# retrieval.py:1810-1837 — no collection authorization check
@router.post('/process/web')
async def process web(
  request: Request,
  form data: ProcessUrlForm,
  user=Depends(get verified user),
  ...
):
  # ... fetch and process the URL ...
  save docs to vector db(
    request=request,
    docs=docs,
    collection name=form data.collection name, # attacker-controlled, unchecked
    overwrite=overwrite,            # defaults to True
    ...
  )

CVSS 3.1 Breakdown

MetricValueRationale
Attack VectorNetwork (N)Exploited remotely via API call
Attack ComplexityLow (L)Single API call with a known KB UUID
Privileges RequiredLow (L)Requires any authenticated user account
User InteractionNone (N)No victim interaction required
ScopeUnchanged (U)Impact within the knowledge base authorization boundary
ConfidentialityNone (N)No data disclosure from this vulnerability directly
IntegrityHigh (H)Complete replacement of victim's KB content with attacker-controlled data
AvailabilityHigh (H)Victim's original KB embeddings are deleted; KB effectively destroyed

Attack Scenario

  1. Attacker discovers victim's KB UUID via the knowledge-bases meta-collection (separate finding) or other enumeration.
  2. Attacker sends:
POST /api/v1/retrieval/process/web?overwrite=true
{
 "url": "https://attacker.com/poison",
 "collection name": "<victim kb uuid>"
}
  1. The endpoint fetches content from the attacker's URL.
  2. save docs to vector db deletes the entire vector collection belonging to the victim's knowledge base.
  3. The attacker's fetched content is embedded and written as the new collection content.
  4. Victim's RAG queries against their KB now return attacker-controlled content instead of their original documents.

Impact

  • Data destruction: Victim's original KB embeddings are permanently deleted from the vector store
  • RAG poisoning: Attacker-controlled content replaces legitimate knowledge, causing the LLM to return misleading or malicious answers to the victim
  • Indirect prompt injection: Poisoned content can contain crafted prompts that manipulate the victim's LLM behavior when queried
  • Persistence: The poisoned content persists until the KB is rebuilt from source files

Preconditions

  • Attacker must have a valid user account
  • Attacker must know the target collection name (KB UUID) — easily obtained via the knowledge-bases enumeration finding

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

PYSEC-2026-2710

Affected Products

Open-Webui