CVE-2026-87498

Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

Linux Distros Unpatched Vulnerability : CVE-2026-87506

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege elevation in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute...

CVE-2026-88000: Loop with Unreachable Exit Condition

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/id/messages/messageid used the chat-history deletion helper in backend/openwebui/models/chats.py to follow childrenIds without recording visited message identifiers...

CVE-2026-87997: Authorization Bypass Through User-Controlled Key

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/openwebui/main.py copied a client-supplied folderid into a new chat without applying the folder write-access chec...

CVE-2026-87995: Improper Neutralization of Input During Web Page Generation

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin. Because the terminal proxy...

CVE-2026-87994: Authorization Bypass Through User-Controlled Key

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chatcompletion in backend/openwebui/main.py checked channel write access and channel membership for a supplied messageid but did not verify that the calling user...

CVE-2026-87017: Exposure of Sensitive Information to an Unauthorized Actor

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.1, the built-in knowledge search tool passed the caller's readable knowledge identifiers through a metadata filter, but the search methods in eleven shipped vector backends ignored that...

CVE-2026-87012: Improper Check for Unusual or Exceptional Conditions

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/openwebui/models/calendar.py stored the calendar event meta.alertminutes value without type validation and the shared upcoming-event scheduler compared that value numerically. An...

PT-2026-89176

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.11.1 Description An issue exists where the platform incorrectly identifies certain internal addresses as external by relying solely on Python's globally routable address classification. This allows an authenticat...

PT-2026-89174

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.10.0 through 0.11.0 Description An issue exists in the chat-completions handler within backend/open webui/main.py where the system fails to verify if a user has write access to a specified folder when creating a new chat...

PT-2026-89162

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.27 through 0.11.0 Description An issue exists in the tool loading routine within backend/open webui/utils/tools.py where a cookie jar is captured from the enclosing connection loop instead of being bound to each externa...

CVE-2026-88002: Loop with Unreachable Exit Condition

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/openwebui/utils/misc.py advanced through a chat history by map key but tracked visited entries using each message body's optional id...

CVE-2026-88001: Server-Side Request Forgery (SSRF)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEBFETCHFILTERLIST or private-address controls to HTTP redirect destinations when AIOHTTPCLIENTALLOWREDIRECTS was enabled. An authenticated user...

CVE-2026-87998: Improper Privilege Management

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/knowledge/id/delete in backend/openwebui/routers/knowledge.py authorized deletion against the knowledge base but then removed its administrator-owned external connection...

CVE-2026-87016: Improper Neutralization of Wildcards or Matching Symbols

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, getuserbyoauthsub and getuserbyscimexternalid in backend/openwebui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject...

PT-2026-89175

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.10.0 through 0.11.0 Description An issue exists in the knowledge base delete handler where a non-administrator user with write access to an external knowledge base can delete the shared instance configuration. This occurs...

Linux Distros Unpatched Vulnerability : CVE-2026-87584

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged page v...

CVE-2026-87014: Insufficient Session Expiration

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/openwebui/routers/auths.py and backend/openwebui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by...

Linux Distros Unpatched Vulnerability : CVE-2026-87498

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin...

PT-2026-89177

Summary Chat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat's new current message walked down the childrenIds links without recording where it had already been. Any account with the default user role could store a chat whose messages...