PYSEC-2026-3595 Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Summary With Redis configured, Open WebUI supports JWT revocation: POST /api/v1/auths/signout per-token jti and OIDC back-channel logout per-user revokedat record revocations in Redis, and HTTP auth getcurrentuser rejects revoked tokens with 401. The realtime authentication surfaces do not perfor...

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

SummaryTwo regexes in backend/openwebui/utils/middleware.py that parse skill-mention tags backtrack in On² on input that contains . Both run synchronously, on the asyncio event loop, on every chat completion with no feature gate. Because the default deployment is a single uvicorn worker, one such...

PYSEC-2026-3604 Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission

Summary POST /api/v1/images/edit performed no authorization beyond requiring a verified account. Every other image-editing surface in Open WebUI enforces the global image-edit switch and the per-user image-generation permission — the /api/v1/images/generations route, the built-in editimage tool,...

PT-2026-67900

Summary The built-in knowledge search tools let a chat participant choose the pattern used to grep knowledge files. Patterns containing regex metacharacters were compiled with Python's backtracking re engine and run against every line of every reachable file, with no time limit anywhere on that...

PT-2026-67929

Summary Any authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. When that happens the renderer falls back to inserting the original math source into the page as HTML rather than as text, so script in the message runs in the...

PT-2026-67902

Summary A user granted write access to a shared chat folder could permanently delete chats and messages belonging to the folder's owner. Deleting a folder cascades into the owner's chats and the entire subfolder subtree, and the deletion handler required only write access on subfolders instead of...

PT-2026-67905

Summary Any authenticated user with access to a terminal server could get script of their choosing to run in the Open WebUI origin itself. The HTML file preview rendered terminal-served files in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, and the file is serv...

PT-2026-67833

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.34 through 0.10.x Description Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer's browser without a restricted resource loader. This allows a user to place a...

PT-2026-67835

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.8.0 through 0.10.9 Description When the ENABLE OAUTH TOKEN EXCHANGE variable is set to True, the endpoint /oauth/provider/token/exchange also identified as POST /api/v1/auths/oauth/provider/token/exchange fails to verify...

PT-2026-67861

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.6 through 0.10.x Description The built-in knowledge search tools allow a chat participant to specify a pattern used to grep knowledge files. When patterns contain regex metacharacters, they are compiled using Python's...

PT-2026-67915

Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the literal IPv6 address and do...

PT-2026-67903

Summary A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the...

PT-2026-67932

Summary The OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provider's userinfo endpoint. A userinfo endpoint reports only that a token is valid, never which OAuth client it was issued to, and the endpoint performed no audience or client check of...

PT-2026-67926

Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied...

PT-2026-67904

Summary DELETE /api/v1/chats/id cancelled a chat's in-flight tasks before it checked whether the caller was allowed to delete that chat. Any authenticated user who knew another user's chat id could therefore abort that user's running model response, title generation or tag generation. The deletio...

CVE-2026-70489: Uncontrolled Resource Consumption

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/openwebui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then walked forward one interval at a time to...

CVE-2026-70493: Inefficient Regular Expression Complexity

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/openwebui/tools/knowledgefs.py and backend/openwebui/tools/builtin.py let a chat participant choose a pattern used to grep knowledge files...

PT-2026-67909

Summary The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP dependency chain, and never applies the role check that get verified user enforces on every HTTP terminal route. An account whose role is pending, meaning registered but not approved, or...

PT-2026-67911

Summary Open WebUI lets a client define a model inline on a chat request instead of selecting a saved workspace model. The knowledge attached to such an inline model was used as-is, without checking that the caller can read what it points at. Any authenticated user who knows another user's file i...

PT-2026-67846

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.8.8 through 0.10.2 Description An issue exists where inline direct model metadata accepts client-supplied knowledge attachments without verifying the caller's read access. This occurs when a client defines a model inline...