← fix library

CRITICAL Open WebUI: Open WebUI CVE-2026-44551 — LDAP empty-password auth bypass

Why it matters

Your Open WebUI version predates 0.9.0. If LDAP login is enabled and the directory accepts empty-password binds (an OpenLDAP default), anyone can log in as any user with a blank password and read their chats, files and API keys.

Fix it — 2 steps

1. Upgrade Open WebUI to 0.9.0 or later (docker: pull the latest image and recreate the container).
2. If you cannot upgrade immediately, disable LDAP login or enforce non-empty passwords on the LDAP server.

Verify it’s fixed

curl -m 5 http://YOUR_SERVER_IP:8080/api/config  # "version" must be >= 0.9.0

References

• https://github.com/advisories/GHSA-2r4p-jpmg-48f4