CVE-2026-70493 Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/openwebui/tools/knowledgefs.py and backend/openwebui/tools/builtin.py let a chat participant choose a pattern used to grep knowledge files...

Cross-site Scripting (XSS)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Cross-site Scripting XSS via the KatexRenderer process in the message rendering component. An attacker can execute arbitrary scripts in the browser of any user who views a crafted message by embedding malicio...

GHSA-PWXH-7358-JQ2X Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Summary Any authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. When that happens the renderer falls back to inserting the original math source into the page as HTML rather than as text, so script in the message runs in the...

CVE-2026-70492 Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte could store and render a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Th...

CVE-2026-70492 Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte could store and render a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Th...

CVE-2026-70492

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte could store and render a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Th...

EUVD-2026-52923

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte could store and render a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Th...

CVE-2026-70492

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte could store and render a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Th...

CVE-2026-70492

Open WebUI had a stored XSS vulnerability in KaTeX render-fallback: between 0.10.0 and 0.11.0, KaTeX errors could be rendered via HTML (via {@html}) in rendered messages, allowing script execution in viewers’ browsers and risking session token theft and potential admin account takeovers. Affected...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-70491 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-70491 Source advisory: GHSA-3R7G-Q6CG-Q2VX...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-70491 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-70491 Source advisory: OSV:GHSA-3R7G-Q6CG-Q2VX...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-70491 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-70491 Source advisory: SNYK:PYTHON-OPENWEBUI-18600527...

Information Exposure

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Information Exposure via the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints. An attacker can access sensitive source code and potentially embedded secrets by making...

EUVD-2026-52922

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...

CVE-2026-70491

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...

CVE-2026-70491

Open WebUI vulnerability CVE-2026-70491 affects the self-hosted Open WebUI platform. In versions up to 0.10.2, the GET endpoints /api/v1/tools/, /api/v1/tools/list, and /api/v1/tools/id/{id} exposed full Python tool source to authenticated non-admin read-only users due to the interaction between ...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-70491 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-70491 Source advisory: MEND:CVE-2026-70491...

CVE-2026-70491 Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...

CVE-2026-70491 Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...

CVE-2026-70491

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...