CVE-2026-41205 vulnerabilities

Vulnerabilities for packages: superset, dagster, mlflow, airflow, airflow-core, pgadmin4-fips, jupyter-base-notebook, prefect-fips, dagster-fips, nemo, open-webui...

CVE-2026-41425 vulnerabilities

Vulnerabilities for packages: datahub-ingestion-fips, mlflow, airflow, pgadmin4-fips, datahub-ingestion, open-webui...

CVE-2026-41481 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-41313 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-41168 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-41312 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-41182 vulnerabilities

Vulnerabilities for packages: langfuse, open-webui...

CVE-2026-42215 vulnerabilities

Vulnerabilities for packages: checkov, mlflow, open-webui...

CVE-2026-42284 vulnerabilities

Vulnerabilities for packages: checkov, mlflow, open-webui...

CVE-2026-41205 vulnerabilities

Vulnerabilities for packages: mlflow, open-webui, jupyter-base-notebook, airflow, superset...

CVE-2026-41425 vulnerabilities

Vulnerabilities for packages: airflow, mlflow, open-webui...

CVE-2026-44565

creationtimestamp| type| source ---|---|--- 2026-05-05 13:19:17+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-j3fw-wc48-29g3 2026-05-15 01:35:17+00:00| seen|...

CVE-2026-44721

creationtimestamp| type| source ---|---|--- 2026-05-04 23:42:51+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-gf5m-wcrh-7928...

CVE-2026-40260 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-3CRG-W4F6-42MX vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-7GW9-CF7V-778F vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-X284-J5P8-9C5P vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-4PXV-J86V-MHCW vulnerabilities

Vulnerabilities for packages: open-webui...

📄 Open WebUI 0.8.11 Information Disclosure

A potential access control issue was identified in Open WebUI where the Tools API and associated “valves” endpoints may expose sensitive configuration data when accessed with valid authentication tokens. The affected endpoints allow retrieval of tool metadata and configuration structures that may...

PT-2026-41174

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.0 Description An issue exists where administrators' restrictions on API endpoint access can be bypassed. While requests using the Authorization: Bearer header are correctly blocked when restricted from the...