CLEANSTART-2024-DT60070 Use after free in WebUI in Google Chrome prior to 91

Security vulnerability affects the chromium package. Use after free in WebUI in Google Chrome prior to 91...

GHSA-XPV3-W29H-X7CV vulnerabilities

Vulnerabilities for packages: ggshield, az, dask-kubernetes, kubeflow-jupyter-web-app, kubeflow-volumes-web-app, datadog-agent, kubeflow-pipelines-visualization-server, jupyter-base-notebook, k8s-sidecar, kubeflow-pipelines, kubeflow-katib, open-webui, kserve...

CVE-2026-49265 vulnerabilities

Vulnerabilities for packages: ggshield, az, dask-kubernetes, kubeflow-jupyter-web-app, kubeflow-volumes-web-app, datadog-agent, kubeflow-pipelines-visualization-server, jupyter-base-notebook, k8s-sidecar, kubeflow-pipelines, kubeflow-katib, open-webui, kserve...

CVE-2026-102268 vulnerabilities

Vulnerabilities for packages: ggshield, superset, semgrep, datadog-agent, py3-cassandra-medusa, open-webui, kserve...

GHSA-HXM8-2XGR-2P9M vulnerabilities

Vulnerabilities for packages: ggshield, superset, semgrep, datadog-agent, py3-cassandra-medusa, open-webui, kserve...

GHSA-R6X4-923Q-G947 vulnerabilities

Vulnerabilities for packages: ggshield, superset, semgrep, datadog-agent, py3-cassandra-medusa, open-webui, kserve...

CVE-2026-102269 vulnerabilities

Vulnerabilities for packages: ggshield, superset, semgrep, datadog-agent, py3-cassandra-medusa, open-webui, kserve...

CVE-2026-102272 vulnerabilities

Vulnerabilities for packages: ggshield, superset, semgrep, datadog-agent, py3-cassandra-medusa, open-webui, kserve...

GHSA-FFC3-869F-JXW9 vulnerabilities

Vulnerabilities for packages: ggshield, superset, semgrep, datadog-agent, py3-cassandra-medusa, open-webui, kserve...

PT-2026-105868

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through thi...

PT-2026-105870

Summary Any authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had...

PT-2026-105869

Summary With the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who...

Linux Distros Unpatched Vulnerability : CVE-2026-102329

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted...

PT-2026-105872

Summary Any authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. The in-app port preview rendered the content of a previewed port in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, a...

PT-2026-105865

Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is global...

PT-2026-105873

Summary When more than one external tool server is reachable in the same request, a tool call to a server configured for bearer authentication can arrive carrying the calling user's Open WebUI session cookies alongside that server's own key. The cookie jar is built per connection, but the callabl...

PT-2026-105877

Summary On SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account th...

PT-2026-105876

Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...

PT-2026-105878

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

PT-2026-105821

Summary The LightRAG WebUI renders assistant/answer chat content as raw HTML — react-markdown is configured with rehypePlugins=rehypeRaw and skipHtml=false and no HTML sanitizer rehype-sanitize, element allow-list, or custom urlTransform. Because answer content is derived from user-ingested...