PYSEC-2026-4123 Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin

Summary Any authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. The in-app port preview rendered the content of a previewed port in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, a...

Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

SummaryOn SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account the...

PYSEC-2026-4115 Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion

Summary External knowledge connections are created and owned by administrators, and are shared by every external knowledge base bound to them. Deleting an external knowledge base also removed that connection from the instance configuration, with no check on the caller's role and no check for othe...

PYSEC-2026-4119 Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through thi...

Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

SummaryOpen WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is globall...

Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

SummaryThe chat-completions endpoint reads a folder id out of the request body and saves the newly created chat into that folder without checking that the caller is allowed to write there. Any authenticated user who knows a folder's id can put a chat of their own into another user's folder,...

PYSEC-2026-4125 Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

Summary The built-in knowledge search tool returns knowledge bases the calling user has no access to. The tool works out which knowledge bases the caller may read and hands that set to the vector store as a search filter, and that filter is the only access control on the path. Most of the shipped...

CLEANSTART-2024-DT60070 Use after free in WebUI in Google Chrome prior to 91

Security vulnerability affects the chromium package. Use after free in WebUI in Google Chrome prior to 91...

CVE-2026-49265 vulnerabilities

Vulnerabilities for packages: jupyter-base-notebook, kubeflow-volumes-web-app, dask-kubernetes, k8s-sidecar, datadog-agent, kserve, ggshield, open-webui, kubeflow-pipelines-visualization-server, kubeflow-pipelines, kubeflow-katib, kubeflow-jupyter-web-app, az...

GHSA-XPV3-W29H-X7CV vulnerabilities

Vulnerabilities for packages: jupyter-base-notebook, kubeflow-volumes-web-app, dask-kubernetes, k8s-sidecar, datadog-agent, kserve, ggshield, open-webui, kubeflow-pipelines-visualization-server, kubeflow-pipelines, kubeflow-katib, kubeflow-jupyter-web-app, az...

GHSA-HXM8-2XGR-2P9M vulnerabilities

Vulnerabilities for packages: semgrep, py3-cassandra-medusa, datadog-agent, kserve, ggshield, open-webui, superset...

CVE-2026-102268 vulnerabilities

Vulnerabilities for packages: semgrep, py3-cassandra-medusa, datadog-agent, kserve, ggshield, open-webui, superset...

CVE-2026-102272 vulnerabilities

Vulnerabilities for packages: semgrep, py3-cassandra-medusa, datadog-agent, kserve, ggshield, open-webui, superset...

GHSA-FFC3-869F-JXW9 vulnerabilities

Vulnerabilities for packages: semgrep, py3-cassandra-medusa, datadog-agent, kserve, ggshield, open-webui, superset...

GHSA-R6X4-923Q-G947 vulnerabilities

Vulnerabilities for packages: semgrep, py3-cassandra-medusa, datadog-agent, kserve, ggshield, open-webui, superset...

CVE-2026-102269 vulnerabilities

Vulnerabilities for packages: semgrep, py3-cassandra-medusa, datadog-agent, kserve, ggshield, open-webui, superset...

PT-2026-105873

Summary When more than one external tool server is reachable in the same request, a tool call to a server configured for bearer authentication can arrive carrying the calling user's Open WebUI session cookies alongside that server's own key. The cookie jar is built per connection, but the callabl...

Linux Distros Unpatched Vulnerability : CVE-2026-102329

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted...

PT-2026-105868

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through thi...

PT-2026-105878

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...