CVE-2026-88002

creationtimestamp| type| source ---|---|--- 2026-09-10 00:35:06+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-jqhh-cjmq-vmv6 2026-09-10 02:31:55+00:00| seen| https://gist.github.com/alon710/401536538bb41a7576b21df62b940fb2...

CVE-2026-88001

creationtimestamp| type| source ---|---|--- 2026-09-10 00:35:04+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-5x7x-4c3c-qf5w 2026-09-10 01:32:33+00:00| seen| https://gist.github.com/alon710/855b51c2ea136c7c49beab7d27d1ef40...

CVE-2026-88000

creationtimestamp| type| source ---|---|--- 2026-09-10 00:32:33+00:00| seen| https://gist.github.com/alon710/48cdccd93c734ae28b1351fbe3368bd9 2026-09-10 00:35:02+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-3cgp-3cqx-j8w2...

PT-2026-89703

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

PT-2026-89454

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose...

Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

Summary Chat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat's new current message walked down the childrenIds links without recording where it had already been. Any account with the default user role could store a chat whose messages...

GHSA-3CGP-3CQX-J8W2 Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

Summary Chat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat's new current message walked down the childrenIds links without recording where it had already been. Any account with the default user role could store a chat whose messages...

EUVD-2026-75185

Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree...

EUVD-2026-75187

Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets...

GHSA-5X7X-4C3C-QF5W Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

Summary Open WebUI protects server-side web fetches with two controls: the operator's list of excluded hosts, and a check that refuses private and internal addresses. Neither control was applied to the destination of an HTTP redirect. On a deployment where redirect following is enabled, any...

Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

Summary Open WebUI protects server-side web fetches with two controls: the operator's list of excluded hosts, and a check that refuses private and internal addresses. Neither control was applied to the destination of an HTTP redirect. On a deployment where redirect following is enabled, any...

Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

Summary Chat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat's message chain detected repeats using each message's own id field while moving through the history by map key, so a message that simply omitted id was never recorded as visited. A history whose...

GHSA-JQHH-CJMQ-VMV6 Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

Summary Chat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat's message chain detected repeats using each message's own id field while moving through the history by map key, so a message that simply omitted id was never recorded as visited. A history whose...

EUVD-2026-75188

Open WebUI: Any authenticated user can hang the server via a cyclic chat message history...

CVE-2026-88002

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/openwebui/utils/misc.py advanced through a chat history by map key but tracked visited entries using each message body's optional id...

CVE-2026-87997

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/openwebui/main.py copied a client-supplied folderid into a new chat without applying the folder write-access chec...

CVE-2026-87998

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/knowledge/id/delete in backend/openwebui/routers/knowledge.py authorized deletion against the knowledge base but then removed its administrator-owned external connection...

CVE-2026-88001

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEBFETCHFILTERLIST or private-address controls to HTTP redirect destinations when AIOHTTPCLIENTALLOWREDIRECTS was enabled. An authenticated user...

CVE-2026-87999

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...

CVE-2026-88000

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/id/messages/messageid used the chat-history deletion helper in backend/openwebui/models/chats.py to follow childrenIds without recording visited message identifiers...