Skip to content
Openwebui vulnerabilities
Newest
-
openwebui open webui, open-webui +1 more
Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange
CVE-2026-88006
Fix available
6.5 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange
CVE-2026-88005
Fix available
6.5 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Any authenticated user can hang the server via a cyclic chat message history
CVE-2026-88002
Fix available
6.5 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets
CVE-2026-88001
Fix available
5.0 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree
CVE-2026-88000
Fix available
6.5 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
CVE-2026-87999
Fix available
7.1 High
-
openwebui open webui, open-webui +1 more
Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
CVE-2026-87998
Fix available
7.1 High
-
openwebui open webui, open-webui +1 more
Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions
CVE-2026-87997
Fix available
4.3 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
CVE-2026-87996
Fix available
7.7 High
-
openwebui open webui, open-webui +1 more
Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
CVE-2026-87995
Fix available
8.7 High
-
openwebui open webui, open-webui +1 more
Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
CVE-2026-87994
Fix available
4.3 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
CVE-2026-87017
Fix available
4.3 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
CVE-2026-87016
Fix available
8.1 High
-
openwebui open webui, open-webui +1 more
Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication
CVE-2026-87015
Fix available
6.8 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
CVE-2026-87014
Fix available
6.5 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
CVE-2026-87013
Fix available
4.3 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
CVE-2026-87012
Fix available
4.3 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
CVE-2026-87011
Fix available
7.5 High
-
openwebui open webui, open-webui +1 more
Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder
CVE-2026-70494
Fix available
8.1 High
-
openwebui open webui, open-webui +1 more
Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically
CVE-2026-70493
Fix available
6.5 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
CVE-2026-70492
Fix available
8.7 High
-
openwebui open webui, open-webui +1 more
Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints
CVE-2026-70491
Fix available
6.5 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
CVE-2026-70490
Fix available
6.3 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
CVE-2026-70489
Fix available
6.5 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: DNS Rebinding SSRF Bypass
CVE-2026-54020
Fix available
6.3 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup
CVE-2026-70488
Fix available
4.3 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata
CVE-2026-70487
Fix available
5.3 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
CVE-2026-70486
Fix available
8.2 High
-
openwebui open webui, open-webui +1 more
Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
CVE-2026-70485
Fix available
7.1 High
-
openwebui open webui, open-webui +1 more
Open WebUI: Users denied the image-generation permission can still generate images via chat completions
CVE-2026-70484
Fix available
4.3 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint
CVE-2026-70483
Fix available
3.1 Low
-
openwebui open webui, open-webui +1 more
Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
CVE-2026-70482
Fix available
8.1 High
-
openwebui open webui, open-webui +1 more
Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages
CVE-2026-70481
Public exploitFix available
5.4 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering
CVE-2026-70480
Fix available
4.1 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
CVE-2026-70479
Fix available
7.7 High
-
open-webui, openwebui open webui +1 more
open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
CVE-2026-59221
Fix available
7.7 High
-
openwebui open webui, open-webui +1 more
Open WebUI: Arena task endpoints can bypass underlying model access controls
CVE-2026-59225
Fix available
5.4 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)
CVE-2026-59224
Fix available
8.0 High
-
openwebui open webui, open-webui +1 more
Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete
CVE-2026-59212
Fix available
5.4 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching
CVE-2026-59223
Fix available
4.3 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials
CVE-2026-59222
Fix available
6.0 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding
CVE-2026-59215
Fix available
3.1 Low
-
openwebui open webui, open-webui +1 more
Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)
CVE-2026-59213
Fix available
3.5 Low
-
openwebui open webui, open-webui +1 more
Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)
CVE-2026-59217
Fix available
4.3 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id
CVE-2026-59216
Fix available
7.7 High
-
openwebui open webui, open-webui +1 more
Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout
CVE-2026-59219
Fix available
7.1 High
-
openwebui open webui, open-webui +1 more
Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)
CVE-2026-59715
Fix available
3.1 Low
-
openwebui open webui, open-webui +1 more
Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config
CVE-2026-59220
Fix available
6.5 Medium
-
openwebui open webui, open-webui +1 more
Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation
CVE-2026-59226
Fix available
3.1 Low
-
openwebui open webui, open-webui +1 more
Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission
CVE-2026-59227
Fix available
4.3 Medium
- Show olderLoading…