GHSA-7GW9-CF7V-778F vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-4PXV-J86V-MHCW vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-40260 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-3CRG-W4F6-42MX vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-X284-J5P8-9C5P vulnerabilities

Vulnerabilities for packages: open-webui...

📄 Open WebUI 0.8.11 Information Disclosure

A potential access control issue was identified in Open WebUI where the Tools API and associated “valves” endpoints may expose sensitive configuration data when accessed with valid authentication tokens. The affected endpoints allow retrieval of tool metadata and configuration structures that may...

PT-2026-41174

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.0 Description An issue exists where administrators' restrictions on API endpoint access can be bypassed. While requests using the Authorization: Bearer header are correctly blocked when restricted from the...

GHSA-W828-4QHX-VXX3 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-34452 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-34450 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-Q5F5-3GJM-7MFM vulnerabilities

Vulnerabilities for packages: open-webui, py3-vllm-cuda-12.4...

CVE-2026-34450 vulnerabilities

Vulnerabilities for packages: open-webui, py3-vllm-cuda-12.4...

CVE-2026-34452 vulnerabilities

Vulnerabilities for packages: open-webui, py3-vllm-cuda-12.4...

CVE-2026-34225

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.7.2 and below contain a Blind Server Side Request Forgery in the functionality that allows editing an image via a prompt. The affected function performs a GET request to a user-provided U...

CVE-2026-34225

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.7.2 and below contain a Blind Server Side Request Forgery in the functionality that allows editing an image via a prompt. The affected function performs a GET request to a user-provided U...

CVE-2026-34225 Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.7.2 and below contain a Blind Server Side Request Forgery in the functionality that allows editing an image via a prompt. The affected function performs a GET request to a user-provided U...

CVE-2026-34225 Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.7.2 and below contain a Blind Server Side Request Forgery in the functionality that allows editing an image via a prompt. The affected function performs a GET request to a user-provided U...

CVE-2026-34225 Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.7.2 and below contain a Blind Server Side Request Forgery in the functionality that allows editing an image via a prompt. The affected function performs a GET request to a user-provided U...

CVE-2026-34225

Open WebUI vulnerability CVE-2026-34225 affects the Open WebUI self-hosted AI platform (offline). Versions ≤ 0.7.2 expose a Blind Server Side Request Forgery in the image-edit workflow: a GET request to a user-supplied URL with no domain restrictions, enabling access to the local address space. B...

Open WebUI 安全漏洞

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI under open source. Versions of Open WebUI 0.7.2 and earlier contain security vulnerabilities. These vulnerabilities stem from a feature that allows for image editing through prompts, which enables blind server-side...