PT-2026-67833

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.34 through 0.10.x Description Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer's browser without a restricted resource loader. This allows a user to place a...

PT-2026-67858

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.8.8 through 0.10.9 Description The terminal WebSocket route in backend/open webui/routers/terminals.py fails to apply the verified-user role gate that is enforced on HTTP terminal routes. Specifically, the resolve...

Linux Distros Unpatched Vulnerability : CVE-2026-18103

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI Open Management Application Programming Interface port, especially if not...

PT-2026-67832

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.6 through 0.10.9 Description When the WEB LOADER ENGINE variable is set to playwright, the Playwright web loader only validates the top-level page request, allowing sub-resource requests to pass unvalidated. An...

PT-2026-67932

Summary The OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provider's userinfo endpoint. A userinfo endpoint reports only that a token is valid, never which OAuth client it was issued to, and the endpoint performed no audience or client check of...

PT-2026-67924

Summary Open WebUI vetted user-supplied URLs by resolving the hostname once and rejecting private, loopback and link-local addresses, then let the HTTP client resolve that hostname again at connect time. An attacker who controls the authoritative DNS for a hostname they submit can answer with a...

PT-2026-67857

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.10.0 Description Automation recurrence parsing in backend/open webui/utils/automations.py anchors minutely and hourly rules to a fixed date of 2000-01-01. When calculating the next run, the system walks...

PT-2026-67861

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.6 through 0.10.x Description The built-in knowledge search tools allow a chat participant to specify a pattern used to grep knowledge files. When patterns contain regex metacharacters, they are compiled using Python's...

CVE-2026-54020: Time-of-check Time-of-use (TOCTOU) Race Condition

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL validation and rejected private, loopback, and link-local addresses, but the HTTP clients resolved the hostname again at connection time. An authenticat...

CVE-2026-70482: Improper Authentication

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.0, when ENABLEOAUTHTOKENEXCHANGE=True, /oauth/provider/token/exchange accepts a raw provider access token and validates it by calling the provider userinfo endpoint without confirming which...

CVE-2026-70479: Server-Side Request Forgery (SSRF)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, with WEBLOADERENGINE=playwright, the Playwright web loader validates only the top-level page request and lets sub-resource requests pass unvalidated. A page supplied by an authenticated...

CVE-2026-70486: Improper Neutralization of Input During Web Page Generation

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user wi...

CVE-2026-70485: Server-Side Request Forgery (SSRF)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.isglobal to the literal IPv6 address without examining IPv4 addresses embedded in...

CVE-2026-70483: Missing Authorization

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/id cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user's chat id could abort...

CVE-2026-70484: Missing Authorization

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legacy chat-completions features block trusted a client-supplied imagegeneration flag and did not re-check the features.imagegeneration permission that the direct image routes and...

CVE-2026-70481: Improper Access Control

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete handlers accepted any caller holding write access on the channel without checking that the caller wrote the message. Because write access i...

CVE-2026-70480: Server-Side Request Forgery (SSRF)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.34 until 0.11.0, Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer browser without a restricted resource loader. Any user who can place such ...

CVE-2026-18772: Improperly Controlled Sequential Memory Allocation

Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion...

CVE-2026-14219: URL Redirection to Untrusted Site

URL redirection to untrusted site 'open redirect' vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Phishing. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-70494: Missing Authorization

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/id handler in backend/openwebui/routers/folders.py allowed a user granted write access to a shared chat folder to permanently delete chats and messages...