CVE-2026-87994 Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chatcompletion in backend/openwebui/main.py checked channel write access and channel membership for a supplied messageid but did not verify that the calling user...

CVE-2026-87994 Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chatcompletion in backend/openwebui/main.py checked channel write access and channel membership for a supplied messageid but did not verify that the calling user...

RediSearch Injection

Spring AI is vulnerable to RediSearch Injection. The vulnerability is due to RedisChatMemoryRepository.findByMetadata using unsanitized metadata values in RediSearch queries, allowing an attacker to inject RediSearch syntax and retrieve chat messages across conversations...

PT-2026-89174

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.10.0 through 0.11.0 Description An issue exists in the chat-completions handler within backend/open webui/main.py where the system fails to verify if a user has write access to a specified folder when creating a new chat...

CVE-2026-87997: Authorization Bypass Through User-Controlled Key

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/openwebui/main.py copied a client-supplied folderid into a new chat without applying the folder write-access chec...

PT-2026-89171

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.5 through 0.11.0 Description An issue exists in the channel branch of the chat completions handler where the system verifies if a user has write access to a channel and if a specific message belongs to that channel, but...

PT-2026-89177

Summary Chat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat's new current message walked down the childrenIds links without recording where it had already been. Any account with the default user role could store a chat whose messages...

CVE-2026-86082

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make t...

CVE-2026-86077

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the...

CVE-2026-86077

n8n , an open-source workflow automation platform, contained an authorization flaw in the /chat WebSocket route (specifically the canResumeOverChat function in chat-execution-manager.ts). Prior to versions 2.37.7 and 2.38.2 , a resumeToken issued to an anonymous form submitter could be replayed o...

CVE-2026-86077 n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the...

CVE-2026-86077 n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the...

CVE-2026-86077 n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the...

CVE-2026-86082 n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make t...

CVE-2026-86082

n8n , an open source workflow automation platform, is affected by a domain-restriction bypass in the OpenAI Chat Model node . The root cause is that the searchModels code path in loadModels.ts omitted the assertOpenAiCredentialAllowsUrl check, meaning the credential allowed-domain restrictions en...

CVE-2026-86082 n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make t...

ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account

Check Point Research said in a report published today that a single instruction planted in a ChatGPT conversation could cause ChatGPT to quietly work for an attacker while answering the user's question as usual. In the company's proof of concept, that hidden work read data from the user's connect...

WordPress Wise Chat plugin <= 3.4.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Peng Zhou in WordPress Plugin Wise Chat versions = 3.4.1...

PT-2026-88508

Impact The /chat WebSocket route resumed a paused execution from a resume token without checking that the node being resumed was a chat node. n8n hands that token to anonymous form submitters, so a party with no account could present it on the chat route and release an execution waiting at an...

PT-2026-88513

Impact The OpenAI Chat Model node checked a custom base URL against the credential's allowed-domains configuration before sending a request, but the model-search dropdown did not. A request setting options.baseURL on that path reached an arbitrary host with the credential attached, so the domain...