PT-2026-56988

Name of the Vulnerable Software and Affected Versions Hermes WebUI versions prior to 0.51.307 Description An authentication bypass exists that allows unauthenticated remote attackers to circumvent local-origin IP restrictions on onboarding endpoints. This is achieved by supplying a spoofed...

PT-2026-56884

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.9.x Description When Redis is configured, the authentication process for Socket.IO connect, user-join, join-channels, join-note, and the terminal websocket first-message uses the decode token function withou...

PT-2026-56989

Name of the Vulnerable Software and Affected Versions Hermes WebUI versions prior to 0.51.788 Description An unauthenticated remote code execution issue allows remote attackers to execute arbitrary shell commands. This is achieved by accessing embedded terminal API endpoints without credentials...

PT-2026-56883

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.10.0 Description The file upload path fails to apply the necessary write-access checks when the metadata.knowledge id variable is provided. This allows users with read-only permissions to bypass the security...

PT-2026-56828

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.10.0 Description The '/api/v1/auths/signin' endpoint performs user lookups by email and only executes bcrypt password verification if a matching credential is found. This creates a timing difference where request...

PT-2026-56831

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.8.11 through 0.9.x Description An issue exists where the 'POST /api/v1/images/edit' endpoint only requires a verified account and fails to enforce the global image-edit switch or per-user image-generation permissions. Thi...

PT-2026-56880

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.27 through 0.9.x Description The get all models handlers in routers/openai.py and routers/ollama.py incorrectly pass a lambda to the aiocache key instead of the key builder. This causes permission-filtered per-user mode...

PT-2026-56832

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.16 through 0.9.x Description The Socket.IO server is configured with always connect=True, which allows the ydoc:awareness:update and ydoc:document:leave Socket.IO handlers to accept collaborative-document events without...

PT-2026-56881

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.10.0 Description An issue exists in the channel thread parent and reply handling where the parent id is not bound to the channel in the URL. This allows an authenticated user to reference a message from a differe...

PT-2026-56827

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.10.0 Description Open WebUI runs client-side Python using Pyodide a Python distribution for the browser within a same-origin web worker. This allows stored chat payloads to utilize pyodide.http.pyfetch, the js...

CVE-2026-5923 Poly Voice – Potential Unauthorized Modification of WebUI using CSRF Attack

Malicious use of a stolen cookie might allow modifications to the contents of the IP phone’s webpage...

Server-side Request Forgery (SSRF)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the loadurlimage function, which performs a GET request on user-supplied URLs without restricting the domain. An attacker can access internal network resources and perform...

EUVD-2026-22188

Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality...

GHSA-XC8P-9RR6-97R2 Open WebUI vulnerable to Stored XSS via iFrame in citations model

Summary Manually modifying chat history allows setting the html property within document metadata. This causes the frontend to enter a code path that treats document contents as HTML, and render them in an iFrame when the citation is previewed. This allows stored XSS via a weaponised document...

Cross-site Scripting (XSS)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Cross-site Scripting XSS in the CitationModal process. An attacker can execute arbitrary JavaScript in the context of another user's session by crafting a malicious document payload and manipulating the html...

Cross-site Scripting (XSS)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Cross-site Scripting XSS in the rendering of chat messages containing certain HTML tags using the @html functionality in Svelte. An attacker can execute arbitrary JavaScript in the context of a user's browser...

GHSA-9F4F-JV96-8766 Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions

Summary A vulnerability in the way certain html tags in chat messages are rendered allows attackers to inject JavaScript code into a chat transcript. The JavaScript code will be executed in the user's browser every time that chat transcript is opened, allowing attackers to retrieve the user's...

EUVD-2025-13498

Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions...

PYSEC-2026-1726 Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web

Summary A Server-Side Request Forgery SSRF vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints AWS/GCP/Azure, scan internal networks, access internal services behind...

PYSEC-2026-1732 open-webui is Vulnerable to Incorrect Access Control

open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers a normal user to stop arbitrary LLM response tasks...