open-webui
PyPI148 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting open-webuipage 3 of 3
- CVE-2026-59216CRITICALCVSS 9.0EG 9.0fixed in 0.10.02026-07-09
vulnerable: 0.1.124 ... 0.9.6 (158 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call delivered execute:python and execute:tool Socket.IO events to a client-supplied session_id after checking only that the s…
- CVE-2026-59217MEDIUMCVSS 4.3EG 4.3fixed in 0.10.02026-07-09
vulnerable: 0.1.124 ... 0.9.6 (158 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the file upload path accepted metadata.knowledge_id and auto-linked uploaded files to a target knowledge base without applying the write…
- CVE-2026-59218MEDIUMCVSS 5.3EG 5.3fixed in 0.10.02026-07-09
vulnerable: 0.1.124 ... 0.9.6 (158 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the /api/v1/auths/signin endpoint looked users up by email and only ran bcrypt password verification when a credential existed, making r…
- CVE-2026-59219HIGHCVSS 7.1EG 7.1fixed in 0.10.02026-07-09
vulnerable: 0.9.0 ... 0.9.6 (7 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0 with Redis configured, Socket.IO connect, user-join, join-channels, join-note, and the terminal websocket first-message authenti…
- CVE-2026-59220MEDIUMCVSS 6.5EG 6.5fixed in 0.10.02026-07-09
vulnerable: 0.9.2, 0.9.3, 0.9.4, 0.9.5, 0.9.6
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.2 before 0.10.0, the SKILL_MENTION_RE and strip_re regular expressions in backend/open_webui/utils/middleware.py parsed <$skillId|label> skill m…
- CVE-2026-59221HIGHCVSS 7.7EG 7.7fixed in 0.10.02026-07-09
vulnerable: 0.9.6
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _sanitize_proxy_path in backend/open_webui/routers/terminals.py decoded proxy paths only eight times, allowing a nine-times per…
- CVE-2026-59222MEDIUMCVSS 6.5EG 6.5fixed in 0.10.02026-07-09
vulnerable: 0.7.0 ... 0.9.6 (23 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 before 0.10.0, GET /api/v1/channels//members returned full UserModelResponse objects for channel members, including settings.ui.toolServers[].…
- CVE-2026-59223MEDIUMCVSS 4.3EG 4.3fixed in 0.10.02026-07-09
vulnerable: 0.1.124 ... 0.9.6 (158 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, WEB_FETCH_FILTER_LIST matching compared configured host entries against URL strings and non-label-boundary suffixes, allowing path-based…
- CVE-2026-59224HIGHCVSS 8.0EG 8.0fixed in 0.10.02026-07-09
vulnerable: 0.1.124 ... 0.9.6 (158 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/open_webui/routers/terminals.py built the ws_terminal upstream URL from an unencoded session_id and appended user_id as a query …
- CVE-2026-59225MEDIUMCVSS 6.3EG 6.3fixed in 0.10.02026-07-09
vulnerable: 0.8.12 ... 0.9.6 (8 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.12 before 0.10.0, an authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through tas…
- CVE-2026-59226MEDIUMCVSS 4.3EG 4.3fixed in 0.10.02026-07-09
vulnerable: 0.9.0 ... 0.9.6 (7 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0, execute_automation rehydrated automation owners without rechecking that they were still active or still had features.automation…
- CVE-2026-59227MEDIUMCVSS 5.4EG 5.4fixed in 0.10.02026-07-09
vulnerable: 0.8.11 ... 0.9.6 (9 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 before 0.10.0, POST /api/v1/images/edit required only a verified account and did not enforce the global image-edit switch or the per-user ima…
- CVE-2026-59714HIGHCVSS 7.1EG 7.1fixed in 0.10.02026-07-24
vulnerable: 0.9.5, 0.9.6
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM chan…
- CVE-2026-59715MEDIUMCVSS 6.5EG 6.5fixed in 0.10.02026-07-09
vulnerable: 0.6.16 ... 0.9.6 (51 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.16 before 0.10.0, the Socket.IO server is configured with always_connect=True. The ydoc:awareness:update and ydoc:document:leave Socket.IO handl…
- CVE-2026-70479HIGHCVSS 7.7EG 7.7fixed in 0.11.02026-08-04
vulnerable: 0.10.0, 0.10.1, 0.10.2, 0.9.6
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, with WEB_LOADER_ENGINE=playwright, the Playwright web loader validates only the top-level page request and lets sub-resource req…
- CVE-2026-70480MEDIUMCVSS 4.1EG 4.1fixed in 0.11.02026-08-04
vulnerable: 0.10.0 ... 0.9.6 (36 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.34 until 0.11.0, Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer browser without …
- CVE-2026-70481MEDIUMCVSS 5.4EG 5.4fixed in 0.11.02026-08-04
vulnerable: 0.10.0 ... 0.9.6 (93 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete handlers accepted any caller holding write access on the channel without checking…
- CVE-2026-70482HIGHCVSS 8.8EG 8.8fixed in 0.11.02026-08-04
vulnerable: 0.10.0 ... 0.9.6 (23 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.0, when ENABLE_OAUTH_TOKEN_EXCHANGE=True, /oauth/{provider}/token/exchange accepts a raw provider access token and validates it by …
- CVE-2026-70483MEDIUMCVSS 4.3EG 4.3fixed in 0.11.02026-08-04
vulnerable: 0.10.0, 0.10.1, 0.10.2, 0.9.6
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/{id} cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any auth…
- CVE-2026-70484MEDIUMCVSS 5.4EG 5.4fixed in 0.11.02026-08-04
vulnerable: 0.10.0 ... 0.9.6 (26 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legacy chat-completions features block trusted a client-supplied image_generation flag and did not re-check the features.ima…
- CVE-2026-70485HIGHCVSS 7.1EG 7.1fixed in 0.11.02026-08-04
vulnerable: 0.10.0 ... 0.9.6 (10 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.is_global to the literal …
- CVE-2026-70486MEDIUMCVSS 5.4EG 5.4fixed in 0.11.02026-08-04
vulnerable: 0.10.0 ... 0.9.6 (10 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files ser…
- CVE-2026-70487MEDIUMCVSS 6.5EG 6.5fixed in 0.11.02026-08-04
vulnerable: 0.10.0 ... 0.9.6 (15 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-supplied knowledge attachments without filtering them against the caller's read acc…
- CVE-2026-70488MEDIUMCVSS 4.3EG 4.3fixed in 0.11.02026-08-04
vulnerable: 0.10.0, 0.10.1, 0.10.2, 0.9.6
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supp…
- CVE-2026-70489MEDIUMCVSS 6.5EG 6.5fixed in 0.11.02026-08-04
vulnerable: 0.10.0 ... 0.9.6 (10 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/open_webui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2…
- CVE-2026-70490MEDIUMCVSS 6.3EG 6.3fixed in 0.11.02026-08-04
vulnerable: 0.10.0 ... 0.9.6 (15 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/open_webui/routers/terminals.py authenticated its own first-message JWT and never applie…
- CVE-2026-70491MEDIUMCVSS 6.5EG 6.5fixed in 0.11.02026-08-04
vulnerable: 0.1.124 ... 0.9.6 (161 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/{id} endpoints in backend/open_webui/routers/tools.py ret…
- CVE-2026-70492MEDIUMCVSS 5.4EG 5.4fixed in 0.11.02026-08-04
vulnerable: 0.10.0, 0.10.1, 0.10.2
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte could store and render a chat message whose math block makes KaT…
- CVE-2026-70493MEDIUMCVSS 6.5EG 6.5fixed in 0.11.02026-08-04
vulnerable: 0.10.0, 0.10.1, 0.10.2, 0.9.6
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/open_webui/tools/knowledge_fs.py and backend/open_webui/tools/builtin.py let a cha…
- CVE-2026-70494HIGHCVSS 8.1EG 8.1fixed in 0.11.02026-08-04
vulnerable: 0.10.0, 0.10.1, 0.10.2
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/{id} handler in backend/open_webui/routers/folders.py allowed a user granted write access to a share…
- CVE-2026-87011HIGHCVSS 7.5EG 7.5fixed in 0.11.12026-09-09
vulnerable: 0.10.0 ... 0.9.6 (11 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/open_webui/utils/oauth.py fetched the OIDC discovery docum…
- CVE-2026-87012MEDIUMCVSS 4.3EG 4.3fixed in 0.11.12026-09-09
vulnerable: 0.10.0 ... 0.9.6 (11 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/open_webui/models/calendar.py stored the calendar event meta.alert_minutes value without type validation and the shared …
- CVE-2026-87013MEDIUMCVSS 4.3EG 4.3fixed in 0.11.12026-09-09
vulnerable: 0.10.0, 0.10.1, 0.10.2, 0.11.0
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/{id}/update/parent allowed a user to place a folder under itself or one of its descendants, while the fold…
- CVE-2026-87014MEDIUMCVSS 6.5EG 6.5fixed in 0.11.12026-09-09
vulnerable: 0.10.0 ... 0.9.6 (11 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/open_webui/routers/auths.py and backend/open_webui/utils/oauth.py updated an administrator's dat…
- CVE-2026-87015MEDIUMCVSS 6.8EG 6.8fixed in 0.11.12026-09-09
vulnerable: 0.10.0 ... 0.9.6 (44 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each extern…
- CVE-2026-87016HIGHCVSS 8.1EG 8.1fixed in 0.11.12026-09-09
vulnerable: 0.10.0 ... 0.9.6 (30 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py used JSON contains matching that c…
- CVE-2026-87017MEDIUMCVSS 4.3EG 4.3fixed in 0.11.12026-09-09
vulnerable: 0.10.0 ... 0.9.6 (27 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.1, the built-in knowledge search tool passed the caller's readable knowledge identifiers through a metadata filter, but the search …
- CVE-2026-87994MEDIUMCVSS 4.3EG 4.3fixed in 0.11.12026-09-09
vulnerable: 0.10.0 ... 0.9.6 (6 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chat_completion in backend/open_webui/main.py checked channel write access and channel membership for a su…
- CVE-2026-87995HIGHCVSS 8.7EG 8.7fixed in 0.11.12026-09-09
vulnerable: 0.10.0 ... 0.9.6 (13 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-sc…
- CVE-2026-87996HIGHCVSS 7.7EG 7.7fixed in 0.11.12026-09-09
vulnerable: 0.10.0, 0.10.1, 0.10.2, 0.11.0, 0.9.6
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/open_webui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let…
- CVE-2026-87997MEDIUMCVSS 4.3EG 4.3fixed in 0.11.12026-09-09
vulnerable: 0.10.0, 0.10.1, 0.10.2, 0.11.0
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/open_webui/main.py copied a client-supplied folder_id i…
- CVE-2026-87998HIGHCVSS 7.1EG 7.1fixed in 0.11.12026-09-09
vulnerable: 0.10.0, 0.10.1, 0.10.2, 0.11.0
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/knowledge/{id}/delete in backend/open_webui/routers/knowledge.py authorized deletion against the knowledge base …
- CVE-2026-87999HIGHCVSS 7.1EG 7.1fixed in 0.11.12026-09-09
vulnerable: 0.1.124 ... 0.9.6 (162 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/open_webui/retrieval/web/utils.py treated Py…
- CVE-2026-88000MEDIUMCVSS 6.5EG 6.5fixed in 0.11.12026-09-09
vulnerable: 0.10.0, 0.10.1, 0.10.2, 0.11.0
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/{id}/messages/{message_id} used the chat-history deletion helper in backend/open_webui/models/chats.py to …
- CVE-2026-88001MEDIUMCVSS 5.0EG 5.0fixed in 0.11.12026-09-09
vulnerable: 0.10.0 ... 0.9.6 (6 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEB_FETCH_FILTER_LIST or private-address controls to HTTP redirect destinations when AIO…
- CVE-2026-88002MEDIUMCVSS 6.5EG 6.5fixed in 0.11.12026-09-09
vulnerable: 0.10.0 ... 0.9.6 (94 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/open_webui/utils/misc.py advanced through a chat history by map key but track…
- CVE-2026-88005MEDIUMCVSS 6.5EG 6.5fixed in 0.9.02026-09-10
vulnerable: 0.8.0 ... 0.8.9 (13 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowli…
- CVE-2026-88006MEDIUMCVSS 6.5EG 6.5fixed in 0.11.12026-09-10
vulnerable: 0.10.0 ... 0.9.6 (24 versions)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role managemen…
Check whether open-webui is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for open-webui CVEs against the assets you own.
Book a Demo →