Openwebui Open Webui vulnerabilities

• openwebui open webui, open-webui +1 more Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange CVE-2026-88006 Fix available 6.5 MediumSeptember 10, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange CVE-2026-88005 Fix available 6.5 MediumSeptember 10, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Any authenticated user can hang the server via a cyclic chat message history CVE-2026-88002 Fix available 6.5 MediumSeptember 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets CVE-2026-88001 Fix available 5.0 MediumSeptember 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree CVE-2026-88000 Fix available 6.5 MediumSeptember 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch CVE-2026-87999 Fix available 7.1 HighSeptember 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion CVE-2026-87998 Fix available 7.1 HighSeptember 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions CVE-2026-87997 Fix available 4.3 MediumSeptember 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader CVE-2026-87996 Fix available 7.7 HighSeptember 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin CVE-2026-87995 Fix available 8.7 HighSeptember 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint CVE-2026-87994 Fix available 4.3 MediumSeptember 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends CVE-2026-87017 Fix available 4.3 MediumSeptember 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite CVE-2026-87016 Fix available 8.1 HighSeptember 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication CVE-2026-87015 Fix available 6.8 MediumSeptember 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes CVE-2026-87014 Fix available 6.5 MediumSeptember 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle CVE-2026-87013 Fix available 4.3 MediumSeptember 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value CVE-2026-87012 Fix available 4.3 MediumSeptember 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout CVE-2026-87011 Fix available 7.5 HighSeptember 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder CVE-2026-70494 Fix available 8.1 HighAugust 4, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically CVE-2026-70493 Fix available 6.5 MediumAugust 4, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages CVE-2026-70492 Fix available 8.7 HighAugust 4, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints CVE-2026-70491 Fix available 6.5 MediumAugust 4, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check CVE-2026-70490 Fix available 6.3 MediumAugust 4, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing CVE-2026-70489 Fix available 6.5 MediumAugust 4, 2026
• openwebui open webui, open-webui +1 more Open WebUI: DNS Rebinding SSRF Bypass CVE-2026-54020 Fix available 6.3 MediumAugust 4, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup CVE-2026-70488 Fix available 4.3 MediumAugust 4, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata CVE-2026-70487 Fix available 5.3 MediumAugust 4, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin CVE-2026-70486 Fix available 8.2 HighAugust 4, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs CVE-2026-70485 Fix available 7.1 HighAugust 4, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Users denied the image-generation permission can still generate images via chat completions CVE-2026-70484 Fix available 4.3 MediumAugust 4, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint CVE-2026-70483 Fix available 3.1 LowAugust 4, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client CVE-2026-70482 Fix available 8.1 HighAugust 4, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages CVE-2026-70481 Public exploitFix available 5.4 MediumAugust 4, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering CVE-2026-70480 Fix available 4.1 MediumAugust 4, 2026
• openwebui open webui, open-webui +1 more Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader CVE-2026-70479 Fix available 7.7 HighAugust 4, 2026
• open-webui, openwebui open webui +1 more open-webui terminal proxy path traversal guard bypass via 9x encoded traversal CVE-2026-59221 Fix available 7.7 HighJuly 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Arena task endpoints can bypass underlying model access controls CVE-2026-59225 Fix available 5.4 MediumJuly 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection) CVE-2026-59224 Fix available 8.0 HighJuly 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete CVE-2026-59212 Fix available 5.4 MediumJuly 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching CVE-2026-59223 Fix available 4.3 MediumJuly 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials CVE-2026-59222 Fix available 6.0 MediumJuly 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding CVE-2026-59215 Fix available 3.1 LowJuly 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse) CVE-2026-59213 Fix available 3.5 LowJuly 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB) CVE-2026-59217 Fix available 4.3 MediumJuly 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id CVE-2026-59216 Fix available 7.7 HighJuly 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout CVE-2026-59219 Fix available 7.1 HighJuly 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave) CVE-2026-59715 Fix available 3.1 LowJuly 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config CVE-2026-59220 Fix available 6.5 MediumJuly 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation CVE-2026-59226 Fix available 3.1 LowJuly 9, 2026
• openwebui open webui, open-webui +1 more Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission CVE-2026-59227 Fix available 4.3 MediumJuly 9, 2026
• Show olderLoading…