GHSA-3R7G-Q6CG-Q2VX Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Summary A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the...

Missing Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization via the chat completion, chat completed, and chat action endpoints when an inline model definition is used with attached knowledge metadata. An attacker can access the indexed content of...

Incorrect Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization through the syncknowledgecleanup handler in the backend, which processes directory and file IDs from the request body without verifying their association with the specified knowledge...

CVE-2026-69247 vulnerabilities

Vulnerabilities for packages: kubeflow-volumes-web-app, kserve, datadog-agent, superset, semgrep, in-toto, kubeflow, dask-kubernetes, mycli, airflow, open-webui, mitmproxy, py3-cassandra-medusa, mlflow, ggshield, k8s-sidecar...

CVE-2026-70478

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELISTURLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh...

GHSA-8GJ2-2CVC-6XX7 Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials

Summary The /api/v1/text-to-speech/generate endpoint is whitelisted requires no authentication and accepts any chatflowId without checking whether the referenced chatflow is public. An unauthenticated attacker who knows a valid chatflow UUID can abuse that chatflow's TTS credential OpenAI or...

CVE-2026-70474

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table...

GHSA-P5W8-M249-4R4V

creationtimestamp| type| source ---|---|--- 2026-08-04 17:31:02+00:00| seen| https://gist.github.com/alon710/3c340657379dfd929a73082180747c70...

EUVD-2026-52797

A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function removerule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out...

nanoid: nanoid: Predictable ID generation due to integer overflow

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoidsize function. This issue causes the internal random number generator to become predictable, leading to t...

CVE-2026-15307

creationtimestamp| type| source ---|---|--- 2026-08-04 16:29:42+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/h5c2dvuor5uzy 2026-08-04 19:51:38+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3msbrxt7kt622 2026-08-05 02:23:12+00:00| seen|...

CVE-2026-69258 Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in...

EUVD-2026-52762

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in...

CVE-2026-69110

OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...

CVE-2026-69110 OpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/music

OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...

GHSA-CVXM-645Q-P574

creationtimestamp| type| source ---|---|--- 2026-08-04 15:15:12+00:00| seen| https://gist.github.com/cwayne18/2df919c96745d903491c33321eb89359 2026-08-05 12:34:16+00:00| seen| https://gist.github.com/cwayne18/b5c32c67446c8ec50f54ec955ba4ef5b 2026-08-05 21:55:34+00:00| seen|...

MINI-QH47-R63Q-R35R

Bulletin has no description...

CVE-2024-5866

creationtimestamp| type| source ---|---|--- 2026-08-04 13:00:04+00:00| seen| https://t.me/purpleshift/133 2026-08-05 00:00:30+00:00| seen| https://t.me/purpleshift/133...

PYSEC-2026-3597 open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

AI assistance was used to help inspect the code and prepare this report. Summary The fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and current main. backend/openwebui/routers/terminals.py documents sanitizeproxypath as decoding until stable, but the implementation stops after 8 unquote...

PYSEC-2026-3600 Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

Summary The terminal proxy in backend/openwebui/routers/terminals.py forwards the Open WebUI user's identity to the upstream terminal server / backend coordinator as an authorization claim, with no cryptographic binding to the session that produced it. The forwarded identity is...