Open-webui vulnerabilities
175 CVEs and advisories name Open-webui as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-87017Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
- CVE-2026-87016Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
- CVE-2026-87015Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication
- CVE-2026-87014Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
- CVE-2026-87013Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
- CVE-2026-87012Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
- CVE-2026-87011Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
- CVE-2026-59714Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
- CVE-2026-70494Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder
- CVE-2026-70493Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically
- CVE-2026-70492Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
- CVE-2026-70491Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints
- CVE-2026-70490Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
- CVE-2026-70489Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
- CVE-2026-54020Open WebUI: DNS Rebinding SSRF Bypass
- CVE-2026-70488Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup
- CVE-2026-70487Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata
- CVE-2026-70486Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
- CVE-2026-70485Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
- CVE-2026-70484Open WebUI: Users denied the image-generation permission can still generate images via chat completions
- CVE-2026-70483Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint
- CVE-2026-70482Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
- CVE-2026-70481Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages
- CVE-2026-70480Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering
- CVE-2026-70479Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
- CVE-2026-56400open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation
- CVE-2026-56398Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI
- CVE-2026-59221open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
- CVE-2026-59225Open WebUI: Arena task endpoints can bypass underlying model access controls
- CVE-2026-59224Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)