PT-2026-76484

Summary Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer's browser without a restricted resource loader. Any user who can place such a block where another user will see it can make that user's browser issue attacker-chosen outbound GET...

PT-2026-76471

Summary A user granted write access to a shared chat folder could permanently delete chats and messages belonging to the folder's owner. Deleting a folder cascades into the owner's chats and the entire subfolder subtree, and the deletion handler required only write access on subfolders instead of...

PT-2026-76478

Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the literal IPv6 address and do...

PT-2026-76475

Summary The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP dependency chain, and never applies the role check that get verified user enforces on every HTTP terminal route. An account whose role is pending, meaning registered but not approved, or...

PT-2026-76472

Summary A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the...

PT-2026-76476

Summary Open WebUI lets a client define a model inline on a chat request instead of selecting a saved workspace model. The knowledge attached to such an inline model was used as-is, without checking that the caller can read what it points at. Any authenticated user who knows another user's file i...

PT-2026-76473

Summary DELETE /api/v1/chats/id cancelled a chat's in-flight tasks before it checked whether the caller was allowed to delete that chat. Any authenticated user who knew another user's chat id could therefore abort that user's running model response, title generation or tag generation. The deletio...

PT-2026-76483

Summary Any authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. When that happens the renderer falls back to inserting the original math source into the page as HTML rather than as text, so script in the message runs in the...

PT-2026-76481

Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied...

PT-2026-76480

Summary Open WebUI vetted user-supplied URLs by resolving the hostname once and rejecting private, loopback and link-local addresses, then let the HTTP client resolve that hostname again at connect time. An attacker who controls the authoritative DNS for a hostname they submit can answer with a...

PT-2026-76486

Summary With the Playwright web loader enabled, Open WebUI opens user-submitted URLs in a real browser and validates the destination address before allowing the request. That check only ran for the top-level page request. Every other request the page issued was passed through unvalidated, so a pa...

PT-2026-76470

Summary The built-in knowledge search tools let a chat participant choose the pattern used to grep knowledge files. Patterns containing regex metacharacters were compiled with Python's backtracking re engine and run against every line of every reachable file, with no time limit anywhere on that...

CVE-2026-71554 vulnerabilities

Vulnerabilities for packages: open-webui, mitmproxy, airflow...

GHSA-6HR6-W5QG-QMWG vulnerabilities

Vulnerabilities for packages: prefect-fips, mitmproxy, apache-beam-python-3.14-sdk, open-webui, authentik-fips, jupyter-all-spark-notebook, localstack, authentik, airflow...

open-webui (0.6.41) potentially affected by CVE-2026-67422 via pymdown-extensions (10.17.2)

pymdown-extensions PYPI version 10.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - open-webui 0.6.41 Source cves: CVE-2026-67422 Source advisory: OSV:GHSA-GM37-52C6-37MW...

bestatic (>=0.0.34, <=0.0.36), mkdocs-techdocs-core (1.6.1) +1 more potentially affected by CVE-2026-67422 via pymdown-extensions (10.19.1)

pymdown-extensions PYPI version 10.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - bestatic =0.0.34, =0.6.42, =0.6.43 Source cves: CVE-2026-67422 Source advisory: OSV:GHSA-GM37-52C6-37MW...

open-webui (>=0.7.0, <=0.7.2) potentially affected by CVE-2026-67422 via pymdown-extensions (10.20.0)

pymdown-extensions PYPI version 10.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - open-webui =0.7.0, =0.7.2 Source cves: CVE-2026-67422 Source advisory: OSV:GHSA-GM37-52C6-37MW...

open-webui (>=0.5.17, <=0.6.40), open-webui-steve (0.6.5.45) +1 more potentially affected by CVE-2026-67422 via pymdown-extensions (10.14.2)

pymdown-extensions PYPI version 10.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - open-webui =0.5.17, =0.6.40 - open-webui-steve 0.6.5.45 - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-67422 Sourc...

CVE-2026-70491

creationtimestamp| type| source ---|---|--- 2026-08-04 22:35:12+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-3r7g-q6cg-q2vx 2026-08-05 14:31:53+00:00| seen| https://gist.github.com/alon710/33c3bff7f99aec7fdcddc66966d519a0...

CVE-2026-70492

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte could store and render a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Th...