Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

Summary The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP dependency chain, and never applies the role check that getverifieduser enforces on every HTTP terminal route. An account whose role is pending, meaning registered but not approved, or...

CVE-2026-70490

Open WebUI (self-hosted AI platform) versions 0.8.8–0.11.0 contain a flaw where the terminal WebSocket route in backend/open_webui/routers/terminals.py authenticates its own first-message JWT and omits the verified-user role gate enforced on HTTP terminal routes. As a result, accounts with pendin...

GHSA-73CQ-MCGH-379C Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

Summary In every affected release, automation recurrence parsing anchors minutely and hourly rules at a fixed date of 2000-01-01 and then walks forward one interval at a time to find the next run. A single FREQ=MINUTELY rule therefore enumerates roughly a quarter-century of occurrences,...

GHSA-H6X2-583H-X99R Open WebUI: DNS Rebinding SSRF Bypass

Summary Open WebUI vetted user-supplied URLs by resolving the hostname once and rejecting private, loopback and link-local addresses, then let the HTTP client resolve that hostname again at connect time. An attacker who controls the authoritative DNS for a hostname they submit can answer with a...

CVE-2026-54020 Open WebUI: DNS Rebinding SSRF Bypass

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL validation and rejected private, loopback, and link-local addresses, but the HTTP clients resolved the hostname again at connection time. An authenticat...

CVE-2026-70481

creationtimestamp| type| source ---|---|--- 2026-08-04 20:35:14+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-mj5r-jf49-m3w7...

CVE-2026-70483

creationtimestamp| type| source ---|---|--- 2026-08-04 20:35:09+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-3vf6-64vr-3g56...

CVE-2026-59881 vulnerabilities

Vulnerabilities for packages: datahub-ingestion-fips, lmcache-cuda-12.8, dask-kubernetes, apache-beam-python-3.13-sdk, py3-vllm-cuda-12.4, puppygraph-python, dask-kubernetes-fips, kserve-models-web-app, kserve, py3-cassandra-medusa, py3.13-scanner-test-libraries-aiohttp,...

GHSA-MQ44-7P77-Q5H7 vulnerabilities

Vulnerabilities for packages: datahub-ingestion-fips, lmcache-cuda-12.8, dask-kubernetes, apache-beam-python-3.13-sdk, py3-vllm-cuda-12.4, puppygraph-python, dask-kubernetes-fips, kserve-models-web-app, kserve, py3-cassandra-medusa, py3.13-scanner-test-libraries-aiohttp,...

CVE-2026-70487

Open WebUI (versions 0.8.8–0.11.0) allowed client-supplied knowledge attachments in an inline model to bypass read access checks, enabling any authenticated user who knows another user’s file id to retrieve indexed chunks from that file via builtin knowledge tools. This caused read-only cross-use...

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the literal IPv6 address and do...

CVE-2026-70483 Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/id cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user's chat id could abort...

CVE-2026-16792 Global TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator

An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator LXCO 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS...

Server-side Request Forgery (SSRF)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the SafePlaywrightURLLoader process. An attacker can access sensitive internal resources by submitting a crafted URL when the Playwright web loader is enabled, allowing th...

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

Summary With the Playwright web loader enabled, Open WebUI opens user-submitted URLs in a real browser and validates the destination address before allowing the request. That check only ran for the top-level page request. Every other request the page issued was passed through unvalidated, so a pa...

CVE-2026-70479 Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, with WEBLOADERENGINE=playwright, the Playwright web loader validates only the top-level page request and lets sub-resource requests pass unvalidated. A page supplied by an authenticated...

CVE-2026-70479 Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, with WEBLOADERENGINE=playwright, the Playwright web loader validates only the top-level page request and lets sub-resource requests pass unvalidated. A page supplied by an authenticated...

CVE-2026-69704

Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp deletion helper function. Attackers can inject malicious SQL syntax via the vulnerable GET parameter to perform unauthorized...

CVE-2026-66300

SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3...

python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens

A flaw was found in PyJWT, a Python library for JSON Web Token JWT implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys JWK in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the...