3396 matches found
CVE-2026-70492 Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte could store and render a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Th...
CVE-2026-70492
Open WebUI had a stored XSS vulnerability in KaTeX render-fallback: between 0.10.0 and 0.11.0, KaTeX errors could be rendered via HTML (via {@html}) in rendered messages, allowing script execution in viewers’ browsers and risking session token theft and potential admin account takeovers. Affected...
Information Exposure
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Information Exposure via the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints. An attacker can access sensitive source code and potentially embedded secrets by making...
CVE-2026-70491 Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...
CVE-2026-70491 Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...
CVE-2026-70491
Open WebUI vulnerability CVE-2026-70491 affects the self-hosted Open WebUI platform. In versions up to 0.10.2, the GET endpoints /api/v1/tools/, /api/v1/tools/list, and /api/v1/tools/id/{id} exposed full Python tool source to authenticated non-admin read-only users due to the interaction between ...
CVE-2026-70490 Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/openwebui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that getverifieduser enforces...
Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
Summary In every affected release, automation recurrence parsing anchors minutely and hourly rules at a fixed date of 2000-01-01 and then walks forward one interval at a time to find the next run. A single FREQ=MINUTELY rule therefore enumerates roughly a quarter-century of occurrences,...
CVE-2026-70489 Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/openwebui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then walked forward one interval at a time to...
CVE-2026-70489 Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/openwebui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then walked forward one interval at a time to...
CVE-2026-70489
Technical details about CVE-2026-70489 are not publicly available in the provided documents. Monitor for updates.
Open WebUI: DNS Rebinding SSRF Bypass
Summary Open WebUI vetted user-supplied URLs by resolving the hostname once and rejecting private, loopback and link-local addresses, then let the HTTP client resolve that hostname again at connect time. An attacker who controls the authoritative DNS for a hostname they submit can answer with a...
CVE-2026-54020
Open WebUI (self-hosted AI platform) contains a DNS rebinding SSRF vulnerability (CVE-2026-54020) affecting pre-0.11.0 behavior. An attacker who controls authoritative DNS for a submitted hostname could have validation return a public address while the connection later resolves to an internal add...
CVE-2026-54020 Open WebUI: DNS Rebinding SSRF Bypass
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL validation and rejected private, loopback, and link-local addresses, but the HTTP clients resolved the hostname again at connection time. An authenticat...
GHSA-6XHV-RXHV-PWM4 Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata
Summary Open WebUI lets a client define a model inline on a chat request instead of selecting a saved workspace model. The knowledge attached to such an inline model was used as-is, without checking that the caller can read what it points at. Any authenticated user who knows another user's file i...
GHSA-JXC9-XMC4-GR23 Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup
Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied...
CVE-2026-70488 Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objec...
CVE-2026-70488 Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objec...
CVE-2026-70488
CVE-2026-70488 – Open WebUI : In Open WebUI builds from 0.9.6 to 0.11.0, the sync cleanup endpoint (POST /api/v1/knowledge/{id}/sync/cleanup) did not properly constrain actions to the target knowledge base. The handler authenticated write access via the URL knowledge base, then acted on directory...
