Open WebUI 'LDAP Empty Password' - Authentication Bypass

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accep...

Open WebUI < 0.9.5 - Information Disclosure

Open WebUI 0.9.5 contains an information disclosure vulnerability caused by unauthenticated access to GET /api/v1/retrieval/ endpoint, letting remote attackers retrieve live RAG pipeline configuration without authorization, exploit requires no authentication. id: CVE-2026-45397 info: name: Open...

CVE-2026-59212

creationtimestamp| type| source ---|---|--- 2026-07-24 22:35:07+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-2xwm-4h2q-ggfx...

GHSA-FRVJ-C5QP-XJ4W open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

AI assistance was used to help inspect the code and prepare this report. Summary The fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and current main. backend/openwebui/routers/terminals.py documents sanitizeproxypath as decoding until stable, but the implementation stops after 8 unquote...

GHSA-M3QF-58WF-W979 Open WebUI: Arena task endpoints can bypass underlying model access controls

Summary An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected...

EUVD-2026-42634

Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete...

EUVD-2026-42633

Open WebUI: WEBFETCHFILTERLIST host allow/block filter bypassable via URL path and non-label-boundary matching...

EUVD-2026-42631

Open WebUI: /api/v1/channels/id/members exposes full user model including sensitive credentials...

GHSA-73X5-H92W-XC2J Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding

Summary A normal authenticated user can read the content of a message in a private channel they do not belong to. GET /api/v1/channels/id/messages/messageid/thread authorizes the caller against the URL channel, but the underlying thread lookup loads the thread parent by id and returns it without...

EUVD-2026-42630

Open WebUI: Private channel messages can be disclosed through cross-channel thread parentid binding...

EUVD-2026-42629

Open WebUI: Cross-user model-list exposure via static cache key in getallmodels aiocache key= vs keybuilder= misuse...

EUVD-2026-42625

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout...

EUVD-2026-42618

Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission...

GHSA-FFPJ-XV5C-P3GW Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

Summary Two regexes in backend/openwebui/utils/middleware.py that parse skill-mention tags backtrack in On² on input that contains . Both run synchronously, on the asyncio event loop, on every chat completion with no feature gate. Because the default deployment is a single uvicorn worker, one suc...

EUVD-2026-42620

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation...

EUVD-2026-42616

Open WebUI: Stored web worker XSS via Pyodide...

GHSA-PG7V-JWJ7-P798 vulnerabilities

Vulnerabilities for packages: mlflow, open-webui, superset...

CVE-2026-59203 vulnerabilities

Vulnerabilities for packages: mlflow, open-webui, superset...

PYSEC-2026-3543 Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints

Summary Open WebUI allows admins to restrict which API endpoints an API key can access. When an API key is restricted from /api/v1/messages, requests using the Authorization: Bearer sk-... header are correctly blocked with 403. However, the same key sent via the x-api-key header bypasses the...

CVE-2026-56400

open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with alloworigins= and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the openwebui instance by crafting malicious cross-site requests...