Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

SummaryAn authenticated low-privilege user can execute arbitrary code-interpreter Python and tools inside another user's authenticated session. The Socket.IO event-caller geteventcall delivers execute:python / execute:tool events to a client-supplied sessionid after only checking that the session...

Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

Open WebUI upload metadata can add files to knowledge bases without write permission SummaryOpen WebUI's file upload background processing trusts the client-supplied metadata.knowledgeid value and inserts a knowledgefile association before validating that the uploading user has write access to th...

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

SummaryTwo regexes in backend/openwebui/utils/middleware.py that parse skill-mention tags backtrack in On² on input that contains . Both run synchronously, on the asyncio event loop, on every chat completion with no feature gate. Because the default deployment is a single uvicorn worker, one such...

Open WebUI: Stored web worker XSS via Pyodide

Title: Same-origin Pyodide code execution allows server-side RCE via a shared chat SummaryOpen WebUI runs client-side Python Pyodide in a same-origin web worker. Through Pyodide's JavaScript API pyodide.http.pyfetch, or the js module which exposes the page's fetch / XMLHttpRequest executed Python...

PYSEC-2026-3595 Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Summary With Redis configured, Open WebUI supports JWT revocation: POST /api/v1/auths/signout per-token jti and OIDC back-channel logout per-user revokedat record revocations in Redis, and HTTP auth getcurrentuser rejects revoked tokens with 401. The realtime authentication surfaces do not perfor...

PYSEC-2026-3589 Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

Summary The getallmodels handlers in routers/openai.py and routers/ollama.py intended to cache their permission-filtered model lists per user, but the @cached decorator was misconfigured: it passed a key= lambda instead of keybuilder=. In aiocache 0.12.3 the pinned version, key= is a static cache...

PT-2026-67909

Summary The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP dependency chain, and never applies the role check that get verified user enforces on every HTTP terminal route. An account whose role is pending, meaning registered but not approved, or...

PT-2026-67859

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.11.0 Description Authenticated non-admin users with read-only access can obtain the full Python source code of server-side tools shared with them. This occurs because the response models permitted extra fields,...

PT-2026-67847

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.6 through 0.10.9 Description The sync cleanup endpoint POST /api/v1/knowledge/id/sync/cleanup allows a user with write access to one knowledge base to delete directories and remove file embeddings from another knowledge...

PT-2026-67905

Summary Any authenticated user with access to a terminal server could get script of their choosing to run in the Open WebUI origin itself. The HTML file preview rendered terminal-served files in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, and the file is serv...

PT-2026-67835

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.8.0 through 0.10.9 Description When the ENABLE OAUTH TOKEN EXCHANGE variable is set to True, the endpoint /oauth/provider/token/exchange also identified as POST /api/v1/auths/oauth/provider/token/exchange fails to verify...

CVE-2026-70480: Server-Side Request Forgery (SSRF)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.34 until 0.11.0, Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer browser without a restricted resource loader. Any user who can place such ...

PT-2026-67860

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.10.0 through 0.10.2 Description An authenticated user can store a chat message containing a math block designed to cause a stack overflow in KaTeX. When this occurs, the...

PT-2026-67858

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.8.8 through 0.10.9 Description The terminal WebSocket route in backend/open webui/routers/terminals.py fails to apply the verified-user role gate that is enforced on HTTP terminal routes. Specifically, the resolve...

PT-2026-67832

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.6 through 0.10.9 Description When the WEB LOADER ENGINE variable is set to playwright, the Playwright web loader only validates the top-level page request, allowing sub-resource requests to pass unvalidated. An...

PT-2026-67844

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.11.0 Description An authenticated attacker can bypass URL validation to perform a DNS rebinding attack. The software validates hostnames by resolving them once to reject private, loopback, and link-local addresse...

CVE-2026-70494: Missing Authorization

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/id handler in backend/openwebui/routers/folders.py allowed a user granted write access to a shared chat folder to permanently delete chats and messages...

PT-2026-67902

Summary A user granted write access to a shared chat folder could permanently delete chats and messages belonging to the folder's owner. Deleting a folder cascades into the owner's chats and the entire subfolder subtree, and the deletion handler required only write access on subfolders instead of...

PT-2026-67915

Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the literal IPv6 address and do...

PT-2026-67929

Summary Any authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. When that happens the renderer falls back to inserting the original math source into the page as HTML rather than as text, so script in the message runs in the...