open-webui
PyPI131 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting open-webuipage 3 of 3
- CVE-2026-59215LOWCVSS 3.1EG 3.1✓ Fixed in 0.10.02026-07-09
vulnerable: 0.1.124 ... 0.9.6 (158 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, channel thread parent and reply handling did not bind parent_id to the channel in the URL, allowing an authenticated user to reference a…
- CVE-2026-59216CRITICALCVSS 9.0EG 9.0✓ Fixed in 0.10.02026-07-09
vulnerable: 0.1.124 ... 0.9.6 (158 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call delivered execute:python and execute:tool Socket.IO events to a client-supplied session_id after checking only that the s…
- CVE-2026-59217MEDIUMCVSS 4.3EG 4.3✓ Fixed in 0.10.02026-07-09
vulnerable: 0.1.124 ... 0.9.6 (158 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the file upload path accepted metadata.knowledge_id and auto-linked uploaded files to a target knowledge base without applying the write…
- CVE-2026-59218MEDIUMCVSS 5.3EG 5.3✓ Fixed in 0.10.02026-07-09
vulnerable: 0.1.124 ... 0.9.6 (158 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the /api/v1/auths/signin endpoint looked users up by email and only ran bcrypt password verification when a credential existed, making r…
- CVE-2026-59219HIGHCVSS 7.1EG 7.1✓ Fixed in 0.10.02026-07-09
vulnerable: 0.9.0 ... 0.9.6 (7 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0 with Redis configured, Socket.IO connect, user-join, join-channels, join-note, and the terminal websocket first-message authenti…
- CVE-2026-59220MEDIUMCVSS 6.5EG 6.5✓ Fixed in 0.10.02026-07-09
vulnerable: 0.9.2, 0.9.3, 0.9.4, 0.9.5, 0.9.6
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.2 before 0.10.0, the SKILL_MENTION_RE and strip_re regular expressions in backend/open_webui/utils/middleware.py parsed <$skillId|label> skill m…
- CVE-2026-59221HIGHCVSS 7.7EG 7.7✓ Fixed in 0.10.02026-07-09
vulnerable: 0.9.6
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _sanitize_proxy_path in backend/open_webui/routers/terminals.py decoded proxy paths only eight times, allowing a nine-times per…
- CVE-2026-59222MEDIUMCVSS 6.5EG 6.5✓ Fixed in 0.10.02026-07-09
vulnerable: 0.7.0 ... 0.9.6 (23 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 before 0.10.0, GET /api/v1/channels//members returned full UserModelResponse objects for channel members, including settings.ui.toolServers[].…
- CVE-2026-59223MEDIUMCVSS 4.3EG 4.3✓ Fixed in 0.10.02026-07-09
vulnerable: 0.1.124 ... 0.9.6 (158 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, WEB_FETCH_FILTER_LIST matching compared configured host entries against URL strings and non-label-boundary suffixes, allowing path-based…
- CVE-2026-59224HIGHCVSS 8.0EG 8.0✓ Fixed in 0.10.02026-07-09
vulnerable: 0.1.124 ... 0.9.6 (158 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/open_webui/routers/terminals.py built the ws_terminal upstream URL from an unencoded session_id and appended user_id as a query …
- CVE-2026-59225MEDIUMCVSS 6.3EG 6.3✓ Fixed in 0.10.02026-07-09
vulnerable: 0.8.12 ... 0.9.6 (8 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.12 before 0.10.0, an authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through tas…
- CVE-2026-59226MEDIUMCVSS 4.3EG 4.3✓ Fixed in 0.10.02026-07-09
vulnerable: 0.9.0 ... 0.9.6 (7 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0, execute_automation rehydrated automation owners without rechecking that they were still active or still had features.automation…
- CVE-2026-59227MEDIUMCVSS 5.4EG 5.4✓ Fixed in 0.10.02026-07-09
vulnerable: 0.8.11 ... 0.9.6 (9 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 before 0.10.0, POST /api/v1/images/edit required only a verified account and did not enforce the global image-edit switch or the per-user ima…
- CVE-2026-59714HIGHCVSS 7.1EG 7.1✓ Fixed in 0.10.02026-07-24
vulnerable: 0.9.5, 0.9.6
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM chan…
- CVE-2026-59715MEDIUMCVSS 6.5EG 6.5✓ Fixed in 0.10.02026-07-09
vulnerable: 0.6.16 ... 0.9.6 (51 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.16 before 0.10.0, the Socket.IO server is configured with always_connect=True. The ydoc:awareness:update and ydoc:document:leave Socket.IO handl…
- CVE-2026-70479HIGHCVSS 7.7EG 7.7✓ Fixed in 0.11.02026-08-04
vulnerable: 0.10.0, 0.10.1, 0.10.2, 0.9.6
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, with WEB_LOADER_ENGINE=playwright, the Playwright web loader validates only the top-level page request and lets sub-resource req…
- CVE-2026-70480MEDIUMCVSS 4.1EG 4.1✓ Fixed in 0.11.02026-08-04
vulnerable: 0.10.0 ... 0.9.6 (36 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.34 until 0.11.0, Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer browser without …
- CVE-2026-70481MEDIUMCVSS 5.4EG 5.4✓ Fixed in 0.11.02026-08-04
vulnerable: 0.10.0 ... 0.9.6 (93 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete handlers accepted any caller holding write access on the channel without checking…
- CVE-2026-70482HIGHCVSS 8.1EG 8.1✓ Fixed in 0.11.02026-08-04
vulnerable: 0.10.0 ... 0.9.6 (23 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.0, when ENABLE_OAUTH_TOKEN_EXCHANGE=True, /oauth/{provider}/token/exchange accepts a raw provider access token and validates it by …
- CVE-2026-70483LOWCVSS 3.1EG 3.1✓ Fixed in 0.11.02026-08-04
vulnerable: 0.10.0, 0.10.1, 0.10.2, 0.9.6
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/{id} cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any auth…
- CVE-2026-70484MEDIUMCVSS 4.3EG 4.3✓ Fixed in 0.11.02026-08-04
vulnerable: 0.10.0 ... 0.9.6 (26 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legacy chat-completions features block trusted a client-supplied image_generation flag and did not re-check the features.ima…
- CVE-2026-70485HIGHCVSS 7.1EG 7.1✓ Fixed in 0.11.02026-08-04
vulnerable: 0.10.0 ... 0.9.6 (10 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.is_global to the literal …
- CVE-2026-70486HIGHCVSS 8.2EG 8.2✓ Fixed in 0.11.02026-08-04
vulnerable: 0.10.0 ... 0.9.6 (10 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files ser…
- CVE-2026-70487MEDIUMCVSS 5.3EG 5.3✓ Fixed in 0.11.02026-08-04
vulnerable: 0.10.0 ... 0.9.6 (15 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-supplied knowledge attachments without filtering them against the caller's read acc…
- CVE-2026-70488MEDIUMCVSS 4.3EG 4.3✓ Fixed in 0.11.02026-08-04
vulnerable: 0.10.0, 0.10.1, 0.10.2, 0.9.6
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supp…
- CVE-2026-70489MEDIUMCVSS 6.5EG 6.5✓ Fixed in 0.11.02026-08-04
vulnerable: 0.10.0 ... 0.9.6 (10 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/open_webui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2…
- CVE-2026-70490MEDIUMCVSS 6.3EG 6.3✓ Fixed in 0.11.02026-08-04
vulnerable: 0.10.0 ... 0.9.6 (15 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/open_webui/routers/terminals.py authenticated its own first-message JWT and never applie…
- CVE-2026-70491MEDIUMCVSS 6.5EG 6.5✓ Fixed in 0.11.02026-08-04
vulnerable: 0.1.124 ... 0.9.6 (161 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/{id} endpoints in backend/open_webui/routers/tools.py ret…
- CVE-2026-70492HIGHCVSS 8.7EG 8.7✓ Fixed in 0.11.02026-08-04
vulnerable: 0.10.0, 0.10.1, 0.10.2
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte could store and render a chat message whose math block makes KaT…
- CVE-2026-70493MEDIUMCVSS 6.5EG 6.5✓ Fixed in 0.11.02026-08-04
vulnerable: 0.10.0, 0.10.1, 0.10.2, 0.9.6
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/open_webui/tools/knowledge_fs.py and backend/open_webui/tools/builtin.py let a cha…
- CVE-2026-70494HIGHCVSS 8.1EG 8.1✓ Fixed in 0.11.02026-08-04
vulnerable: 0.10.0, 0.10.1, 0.10.2
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/{id} handler in backend/open_webui/routers/folders.py allowed a user granted write access to a share…
Check whether open-webui is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for open-webui CVEs against the assets you own.
Start Free Scan →