CVE-2026-45672: Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed
The /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes.
What it is
The /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes.
The admin configuration correctly shows ENABLE_CODE_EXECUTION: false. However, the code execution endpoint does not check this flag before forwarding Python code to the Jupyter server. Any authenticated user can execute arbitrary code in the Jupyter container.
Verified against Open WebUI v0.8.11 (latest) Docker on 2026-03-25.
How to check
- Affected: open-webui (pip) <= 0.8.11.
- Compare your installed version with the range above (command below).
How to fix
- Upgrade open-webui to 0.8.12 or later.
pip show open-webui | grep Version