Search
Find a vulnerability
Search criteria
381 vulnerabilities by open-webui
CVE-2026-109572 (GCVE-0-2026-109572)
Vulnerability from nvd – Published: 2026-10-12 22:21 – Updated: 2026-10-13 16:46
VLAI
EPSS
VEX
Title
Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy
Summary
Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/{server_id}/{path} to list or stop other users' terminals and modify terminal policies, injecting environment variables into other users' terminals.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:48 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://github.com/open-webui/open-webui/commit/5… | patch |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.8.6 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109572",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:48:38.972002Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:46:13.259Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.8.6",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.8.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dhlife09"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
},
{
"lang": "en",
"type": "reporter",
"value": "ye11oc4t"
},
{
"lang": "en",
"type": "reporter",
"value": "jiwhan8655"
},
{
"lang": "en",
"type": "reporter",
"value": "Dog-Parka"
}
],
"datePublic": "2026-09-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/{server_id}/{path} to list or stop other users\u0027 terminals and modify terminal policies, injecting environment variables into other users\u0027 terminals."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T22:21:48.699Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-q46m-r89w-j74p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-q46m-r89w-j74p"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/open-webui/open-webui/commit/51bb8cb142f72503e861eeee25ae4dc73c26c36b"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.8.6-before-0.11.4-privilege-escalation-via-terminal-proxy"
}
],
"title": "Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109572",
"datePublished": "2026-10-12T22:21:48.699Z",
"dateReserved": "2026-10-12T19:27:55.342Z",
"dateUpdated": "2026-10-13T16:46:13.259Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109300 (GCVE-0-2026-109300)
Vulnerability from nvd – Published: 2026-10-12 16:04 – Updated: 2026-10-13 18:09
VLAI
EPSS
VEX
Title
Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds
Summary
Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages, chat messages, or citation content that runs JavaScript in viewers' browsers, enabling in-app phishing, or session hijacking where iframeSandboxAllowSameOrigin is enabled.
Severity
4.6 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 18:09 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.6.31 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109300",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T18:09:25.448143Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:09:47.634Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-9wj4-mcm3-ppj6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.6.31",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "KadirArslan"
},
{
"lang": "en",
"type": "reporter",
"value": "5yu4n"
},
{
"lang": "en",
"type": "coordinator",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages, chat messages, or citation content that runs JavaScript in viewers\u0027 browsers, enabling in-app phishing, or session hijacking where iframeSandboxAllowSameOrigin is enabled."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:58.200Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-9wj4-mcm3-ppj6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-9wj4-mcm3-ppj6"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.6.31-before-0.11.4-stored-xss-via-tool-call-embeds"
}
],
"title": "Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109300",
"datePublished": "2026-10-12T16:04:58.200Z",
"dateReserved": "2026-10-12T14:13:39.026Z",
"dateUpdated": "2026-10-13T18:09:47.634Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109299 (GCVE-0-2026-109299)
Vulnerability from nvd – Published: 2026-10-12 16:04 – Updated: 2026-10-13 16:55
VLAI
EPSS
VEX
Title
Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation
Summary
Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:49 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://github.com/open-webui/open-webui/commit/5… | patch |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.9.0 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109299",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:49:05.696356Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:55:13.513Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.9.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:57.527Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-5w58-mwmh-vf2m)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-5w58-mwmh-vf2m"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/open-webui/open-webui/commit/5fb869db221d9599a576e8e2eea9c3314947d25e"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.9.0-before-0.11.4-denial-of-service-via-recurrence-rule-validation"
}
],
"title": "Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109299",
"datePublished": "2026-10-12T16:04:57.527Z",
"dateReserved": "2026-10-12T14:13:39.026Z",
"dateUpdated": "2026-10-13T16:55:13.513Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109298 (GCVE-0-2026-109298)
Vulnerability from nvd – Published: 2026-10-12 16:04 – Updated: 2026-10-13 15:46
VLAI
EPSS
VEX
Title
Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex
Summary
Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grep_knowledge_files with short nested-repetition patterns, blocking the event loop and exhausting worker memory.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:45 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://github.com/open-webui/open-webui/commit/9… | patch |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.11.0 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109298",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:45:40.918439Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:46:25.967Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-gww9-mhgj-pfqh"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.11.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "baeseungwon1010"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grep_knowledge_files with short nested-repetition patterns, blocking the event loop and exhausting worker memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:56.895Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-gww9-mhgj-pfqh)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-gww9-mhgj-pfqh"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/open-webui/open-webui/commit/97e013a66169c4fcd7f26ab9e41a4ff260ffd4da"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.11.0-before-0.11.4-memory-exhaustion-via-knowledge-search-regex"
}
],
"title": "Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109298",
"datePublished": "2026-10-12T16:04:56.895Z",
"dateReserved": "2026-10-12T14:13:39.026Z",
"dateUpdated": "2026-10-13T15:46:25.967Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109297 (GCVE-0-2026-109297)
Vulnerability from nvd – Published: 2026-10-12 16:04 – Updated: 2026-10-12 16:04
VLAI
EPSS
VEX
Title
Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules
Summary
Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded rules (or, in 0.11.0, lowercase frequencies or omitted RRULE prefixes) that expand per-second synchronously, blocking the shared event loop for minutes per request and on every scheduler poll.
Severity
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.11.0 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.11.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "baeseungwon1010"
},
{
"lang": "en",
"type": "reporter",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded rules (or, in 0.11.0, lowercase frequencies or omitted RRULE prefixes) that expand per-second synchronously, blocking the shared event loop for minutes per request and on every scheduler poll."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:56.082Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-whgc-vpjx-m3qh)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-whgc-vpjx-m3qh"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.11.0-before-0.11.4-denial-of-service-via-automation-recurrence-rules"
}
],
"title": "Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109297",
"datePublished": "2026-10-12T16:04:56.082Z",
"dateReserved": "2026-10-12T14:13:39.026Z",
"dateUpdated": "2026-10-12T16:04:56.082Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109296 (GCVE-0-2026-109296)
Vulnerability from nvd – Published: 2026-10-12 16:04 – Updated: 2026-10-12 16:04
VLAI
EPSS
VEX
Title
Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes
Summary
Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Ollama and OpenAI-compatible listing routes to trigger requests carrying configured API keys, read version strings, and enumerate connections.
Severity
4.3 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ahkarl13"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Ollama and OpenAI-compatible listing routes to trigger requests carrying configured API keys, read version strings, and enumerate connections."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:55.400Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-hm62-64q2-6gxw)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-hm62-64q2-6gxw"
},
{
"name": "VulnCheck Advisory: Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-before-0.11.4-missing-authorization-via-backend-index-on-model-routes"
}
],
"title": "Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109296",
"datePublished": "2026-10-12T16:04:55.400Z",
"dateReserved": "2026-10-12T14:12:52.833Z",
"dateUpdated": "2026-10-12T16:04:55.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109295 (GCVE-0-2026-109295)
Vulnerability from nvd – Published: 2026-10-12 16:04 – Updated: 2026-10-13 18:09
VLAI
EPSS
VEX
Title
Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop
Summary
Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grep_knowledge_files or grep_chat_files with a catastrophically backtracking regex, blocking the event loop for two seconds per repeated call.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 18:08 UTC
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.11.0 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109295",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T18:08:41.758895Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:09:05.825Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-gfjp-5hc9-852r"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.11.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "yousif-IQ"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grep_knowledge_files or grep_chat_files with a catastrophically backtracking regex, blocking the event loop for two seconds per repeated call."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:54.739Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-gfjp-5hc9-852r)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-gfjp-5hc9-852r"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.11.0-before-0.11.4-redos-via-grep-knowledge-files-event-loop"
}
],
"title": "Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109295",
"datePublished": "2026-10-12T16:04:54.739Z",
"dateReserved": "2026-10-12T14:12:52.833Z",
"dateUpdated": "2026-10-13T18:09:05.825Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109294 (GCVE-0-2026-109294)
Vulnerability from nvd – Published: 2026-10-12 16:04 – Updated: 2026-10-13 16:55
VLAI
EPSS
VEX
Title
Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image
Summary
Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, which get_image_base64_from_url decompresses unbounded, causing denial of service for all users.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:49 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.6.42 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109294",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:49:06.873464Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:55:21.600Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.6.42",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.6.42",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "y4rvin"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, which get_image_base64_from_url decompresses unbounded, causing denial of service for all users."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:54.107Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-w8j8-jv6j-3m47)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-w8j8-jv6j-3m47"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.6.42-before-0.11.4-memory-exhaustion-via-compressed-remote-image"
}
],
"title": "Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109294",
"datePublished": "2026-10-12T16:04:54.107Z",
"dateReserved": "2026-10-12T14:12:52.833Z",
"dateUpdated": "2026-10-13T16:55:21.600Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109293 (GCVE-0-2026-109293)
Vulnerability from nvd – Published: 2026-10-12 16:04 – Updated: 2026-10-13 15:44
VLAI
EPSS
VEX
Title
Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint
Summary
Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of read-only shared tools, exposing embedded API keys and credentials.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:43 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.11.0 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109293",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:43:50.350400Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:44:47.679Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-2h26-836q-4jh2"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.11.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "gigioneggiando"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of read-only shared tools, exposing embedded API keys and credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:53.493Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-2h26-836q-4jh2)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-2h26-836q-4jh2"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.11.0-before-0.11.4-tool-source-disclosure-via-tool-export-endpoint"
}
],
"title": "Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109293",
"datePublished": "2026-10-12T16:04:53.493Z",
"dateReserved": "2026-10-12T14:12:52.833Z",
"dateUpdated": "2026-10-13T15:44:47.679Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109292 (GCVE-0-2026-109292)
Vulnerability from nvd – Published: 2026-10-12 16:04 – Updated: 2026-10-12 16:04
VLAI
EPSS
VEX
Title
Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections
Summary
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.
Severity
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://github.com/open-webui/open-webui/commit/f… | patch |
| https://github.com/open-webui/open-webui/commit/b… | patch |
| https://github.com/open-webui/open-webui/commit/3… | patch |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.6.27 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.6.27",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.6.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "gigioneggiando"
},
{
"lang": "en",
"type": "reporter",
"value": "brodmart"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:52.925Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-gqfh-jxvw-74rp)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-gqfh-jxvw-74rp"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/open-webui/open-webui/commit/f9f815c86220f809fad5ee1300c44f55dea74c79"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/open-webui/open-webui/commit/b71744b17823f7a3a9a64cb363e79a7164ed5b23"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/open-webui/open-webui/commit/3cda47cdb449aac970426f0929c9e5f8bb8bd807"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.6.27-before-0.11.4-session-token-disclosure-via-oauth-mode-connections"
}
],
"title": "Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109292",
"datePublished": "2026-10-12T16:04:52.925Z",
"dateReserved": "2026-10-12T14:12:52.833Z",
"dateUpdated": "2026-10-12T16:04:52.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109291 (GCVE-0-2026-109291)
Vulnerability from nvd – Published: 2026-10-12 16:04 – Updated: 2026-10-12 16:04
VLAI
EPSS
VEX
Title
Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url
Summary
Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embed_url fields. Attackers can share a crafted chat whose citation, when clicked, is passed to window.open, letting them steal localStorage.token and act as the victim.
Severity
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.6.33 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.6.33",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.6.33",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zyakir13"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims\u0027 sessions by storing javascript: URLs in citation embed_url fields. Attackers can share a crafted chat whose citation, when clicked, is passed to window.open, letting them steal localStorage.token and act as the victim."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:52.313Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-qpqv-xwg8-cqpj)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-qpqv-xwg8-cqpj"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.6.33-before-0.11.4-stored-xss-via-citation-embed-url"
}
],
"title": "Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109291",
"datePublished": "2026-10-12T16:04:52.313Z",
"dateReserved": "2026-10-12T14:12:52.833Z",
"dateUpdated": "2026-10-12T16:04:52.313Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109290 (GCVE-0-2026-109290)
Vulnerability from nvd – Published: 2026-10-12 16:04 – Updated: 2026-10-13 18:08
VLAI
EPSS
VEX
Title
Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview
Summary
Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing administrator's session token from local storage and take over the instance.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 18:07 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.11.1 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109290",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T18:07:52.173676Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:08:17.883Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-f9xp-mfmq-x6cg"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.11.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.11.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Observerkay"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing administrator\u0027s session token from local storage and take over the instance."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:51.655Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-f9xp-mfmq-x6cg)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-f9xp-mfmq-x6cg"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.11.1-before-0.11.4-stored-xss-via-docx-preview"
}
],
"title": "Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109290",
"datePublished": "2026-10-12T16:04:51.655Z",
"dateReserved": "2026-10-12T14:12:52.833Z",
"dateUpdated": "2026-10-13T18:08:17.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109289 (GCVE-0-2026-109289)
Vulnerability from nvd – Published: 2026-10-12 16:04 – Updated: 2026-10-13 16:55
VLAI
EPSS
VEX
Title
Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket
Summary
Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through an already open terminal WebSocket. Because the terminal proxy route in terminals.py checks access only on the first message, deactivated users can keep running commands and reading or writing files on the terminal server.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:49 UTC
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.8.8 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109289",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:49:08.346342Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:55:31.359Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.8.8",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.8.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zyakir13"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through an already open terminal WebSocket. Because the terminal proxy route in terminals.py checks access only on the first message, deactivated users can keep running commands and reading or writing files on the terminal server."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:51.020Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-6g45-8g27-fh8q)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-6g45-8g27-fh8q"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.8.8-before-0.11.4-improper-session-revocation-via-terminal-websocket"
}
],
"title": "Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109289",
"datePublished": "2026-10-12T16:04:51.020Z",
"dateReserved": "2026-10-12T14:12:52.833Z",
"dateUpdated": "2026-10-13T16:55:31.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109288 (GCVE-0-2026-109288)
Vulnerability from nvd – Published: 2026-10-12 16:04 – Updated: 2026-10-13 15:39
VLAI
EPSS
VEX
Title
Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links
Summary
Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal the victim's JWT from local storage, including admins' tokens.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:39 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109288",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:39:15.981425Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:39:33.693Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-wf9m-46cp-c6h6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "r20z19"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal the victim\u0027s JWT from local storage, including admins\u0027 tokens."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:50.352Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-wf9m-46cp-c6h6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-wf9m-46cp-c6h6"
},
{
"name": "VulnCheck Advisory: Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-before-0.11.4-stored-xss-via-javascript-urls-in-markdown-links"
}
],
"title": "Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109288",
"datePublished": "2026-10-12T16:04:50.352Z",
"dateReserved": "2026-10-12T14:12:52.833Z",
"dateUpdated": "2026-10-13T15:39:33.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109287 (GCVE-0-2026-109287)
Vulnerability from nvd – Published: 2026-10-12 16:04 – Updated: 2026-10-12 16:04
VLAI
EPSS
VEX
Title
Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID
Summary
Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET /api/v1/knowledge/{id}/files. The returned breadcrumbs expose folder names, owner user ids and knowledge base ids of that directory and all its ancestors.
Severity
4.3 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.9.6 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.9.6",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.9.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "0xMax-Sec"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET /api/v1/knowledge/{id}/files. The returned breadcrumbs expose folder names, owner user ids and knowledge base ids of that directory and all its ancestors."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:49.037Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jx3w-3pqq-7f3w)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-jx3w-3pqq-7f3w"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.9.6-before-0.11.4-information-disclosure-via-unscoped-directory-id"
}
],
"title": "Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109287",
"datePublished": "2026-10-12T16:04:49.037Z",
"dateReserved": "2026-10-12T14:12:52.833Z",
"dateUpdated": "2026-10-12T16:04:49.037Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109286 (GCVE-0-2026-109286)
Vulnerability from nvd – Published: 2026-10-12 16:04 – Updated: 2026-10-12 16:04
VLAI
EPSS
VEX
Title
Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal
Summary
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim's JWT for full API access.
Severity
CWE
- CWE-346 - Origin Validation Error
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.7.0 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.7.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zyakir13"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user\u0027s session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim\u0027s JWT for full API access."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:48.429Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-vpq8-f445-hcq7)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-vpq8-f445-hcq7"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.7.0-before-0.11.4-session-token-theft-via-syncstatsmodal"
}
],
"title": "Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109286",
"datePublished": "2026-10-12T16:04:48.429Z",
"dateReserved": "2026-10-12T14:12:03.637Z",
"dateUpdated": "2026-10-12T16:04:48.429Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109285 (GCVE-0-2026-109285)
Vulnerability from nvd – Published: 2026-10-12 16:04 – Updated: 2026-10-13 18:07
VLAI
EPSS
VEX
Title
Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata
Summary
Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file content endpoint or delete them, including from the owner's private knowledge bases.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 18:07 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.6.0 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109285",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T18:07:07.258448Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:07:30.905Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-9cxp-636w-4997"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.6.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "torjan0"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file content endpoint or delete them, including from the owner\u0027s private knowledge bases."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:47.776Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-9cxp-636w-4997)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-9cxp-636w-4997"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.6.0-before-0.11.4-improper-access-control-via-stale-file-metadata"
}
],
"title": "Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109285",
"datePublished": "2026-10-12T16:04:47.776Z",
"dateReserved": "2026-10-12T14:12:03.637Z",
"dateUpdated": "2026-10-13T18:07:30.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109284 (GCVE-0-2026-109284)
Vulnerability from nvd – Published: 2026-10-12 16:04 – Updated: 2026-10-13 16:55
VLAI
EPSS
VEX
Title
Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint
Summary
Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat's folder without checking folder write access. Shared folder members downgraded to read-only can call POST /api/v1/chats/{id}/fork on chats they created there while they had write access, inserting attacker-controlled chats visible to the folder owner and members.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:49 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.11.0 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109284",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:49:10.630395Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:55:38.201Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.11.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "avrlab233"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat\u0027s folder without checking folder write access. Shared folder members downgraded to read-only can call POST /api/v1/chats/{id}/fork on chats they created there while they had write access, inserting attacker-controlled chats visible to the folder owner and members."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:46.613Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-6fjc-5cg3-mgvh)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-6fjc-5cg3-mgvh"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.11.0-before-0.11.4-improper-authorization-via-chat-fork-endpoint"
}
],
"title": "Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109284",
"datePublished": "2026-10-12T16:04:46.613Z",
"dateReserved": "2026-10-12T14:12:03.637Z",
"dateUpdated": "2026-10-13T16:55:38.201Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109283 (GCVE-0-2026-109283)
Vulnerability from nvd – Published: 2026-10-12 16:04 – Updated: 2026-10-13 15:38
VLAI
EPSS
VEX
Title
Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange
Summary
Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a linked account whose identity provider role no longer satisfies the OAuth role policy can send a valid provider access token to POST /api/v1/auths/oauth/{provider}/token/exchange to obtain a session retaining their previous role.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:37 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.11.1 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109283",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:37:20.530379Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:38:33.216Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-2rr4-q6pg-m5g3"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.11.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.11.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "manus-pi"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
},
{
"lang": "en",
"type": "reporter",
"value": "manus-use"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider\u0027s userinfo response and keeps the user\u0027s existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a linked account whose identity provider role no longer satisfies the OAuth role policy can send a valid provider access token to POST /api/v1/auths/oauth/{provider}/token/exchange to obtain a session retaining their previous role."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:46.013Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-2rr4-q6pg-m5g3)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-2rr4-q6pg-m5g3"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.11.1-before-0.11.4-authorization-bypass-via-oauth-token-exchange"
}
],
"title": "Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109283",
"datePublished": "2026-10-12T16:04:46.013Z",
"dateReserved": "2026-10-12T14:12:03.637Z",
"dateUpdated": "2026-10-13T15:38:33.216Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109572 (GCVE-0-2026-109572)
Vulnerability from cvelistv5 – Published: 2026-10-12 22:21 – Updated: 2026-10-13 16:46
VLAI
EPSS
VEX
Title
Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy
Summary
Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/{server_id}/{path} to list or stop other users' terminals and modify terminal policies, injecting environment variables into other users' terminals.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:48 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://github.com/open-webui/open-webui/commit/5… | patch |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.8.6 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109572",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:48:38.972002Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:46:13.259Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.8.6",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.8.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dhlife09"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
},
{
"lang": "en",
"type": "reporter",
"value": "ye11oc4t"
},
{
"lang": "en",
"type": "reporter",
"value": "jiwhan8655"
},
{
"lang": "en",
"type": "reporter",
"value": "Dog-Parka"
}
],
"datePublic": "2026-09-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/{server_id}/{path} to list or stop other users\u0027 terminals and modify terminal policies, injecting environment variables into other users\u0027 terminals."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T22:21:48.699Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-q46m-r89w-j74p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-q46m-r89w-j74p"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/open-webui/open-webui/commit/51bb8cb142f72503e861eeee25ae4dc73c26c36b"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.8.6-before-0.11.4-privilege-escalation-via-terminal-proxy"
}
],
"title": "Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109572",
"datePublished": "2026-10-12T22:21:48.699Z",
"dateReserved": "2026-10-12T19:27:55.342Z",
"dateUpdated": "2026-10-13T16:46:13.259Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109300 (GCVE-0-2026-109300)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:04 – Updated: 2026-10-13 18:09
VLAI
EPSS
VEX
Title
Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds
Summary
Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages, chat messages, or citation content that runs JavaScript in viewers' browsers, enabling in-app phishing, or session hijacking where iframeSandboxAllowSameOrigin is enabled.
Severity
4.6 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 18:09 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.6.31 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109300",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T18:09:25.448143Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:09:47.634Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-9wj4-mcm3-ppj6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.6.31",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "KadirArslan"
},
{
"lang": "en",
"type": "reporter",
"value": "5yu4n"
},
{
"lang": "en",
"type": "coordinator",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages, chat messages, or citation content that runs JavaScript in viewers\u0027 browsers, enabling in-app phishing, or session hijacking where iframeSandboxAllowSameOrigin is enabled."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:58.200Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-9wj4-mcm3-ppj6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-9wj4-mcm3-ppj6"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.6.31-before-0.11.4-stored-xss-via-tool-call-embeds"
}
],
"title": "Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109300",
"datePublished": "2026-10-12T16:04:58.200Z",
"dateReserved": "2026-10-12T14:13:39.026Z",
"dateUpdated": "2026-10-13T18:09:47.634Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109299 (GCVE-0-2026-109299)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:04 – Updated: 2026-10-13 16:55
VLAI
EPSS
VEX
Title
Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation
Summary
Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:49 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://github.com/open-webui/open-webui/commit/5… | patch |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.9.0 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109299",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:49:05.696356Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:55:13.513Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.9.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:57.527Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-5w58-mwmh-vf2m)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-5w58-mwmh-vf2m"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/open-webui/open-webui/commit/5fb869db221d9599a576e8e2eea9c3314947d25e"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.9.0-before-0.11.4-denial-of-service-via-recurrence-rule-validation"
}
],
"title": "Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109299",
"datePublished": "2026-10-12T16:04:57.527Z",
"dateReserved": "2026-10-12T14:13:39.026Z",
"dateUpdated": "2026-10-13T16:55:13.513Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109298 (GCVE-0-2026-109298)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:04 – Updated: 2026-10-13 15:46
VLAI
EPSS
VEX
Title
Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex
Summary
Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grep_knowledge_files with short nested-repetition patterns, blocking the event loop and exhausting worker memory.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:45 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://github.com/open-webui/open-webui/commit/9… | patch |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.11.0 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109298",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:45:40.918439Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:46:25.967Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-gww9-mhgj-pfqh"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.11.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "baeseungwon1010"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grep_knowledge_files with short nested-repetition patterns, blocking the event loop and exhausting worker memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:56.895Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-gww9-mhgj-pfqh)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-gww9-mhgj-pfqh"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/open-webui/open-webui/commit/97e013a66169c4fcd7f26ab9e41a4ff260ffd4da"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.11.0-before-0.11.4-memory-exhaustion-via-knowledge-search-regex"
}
],
"title": "Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109298",
"datePublished": "2026-10-12T16:04:56.895Z",
"dateReserved": "2026-10-12T14:13:39.026Z",
"dateUpdated": "2026-10-13T15:46:25.967Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109297 (GCVE-0-2026-109297)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:04 – Updated: 2026-10-12 16:04
VLAI
EPSS
VEX
Title
Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules
Summary
Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded rules (or, in 0.11.0, lowercase frequencies or omitted RRULE prefixes) that expand per-second synchronously, blocking the shared event loop for minutes per request and on every scheduler poll.
Severity
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.11.0 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.11.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "baeseungwon1010"
},
{
"lang": "en",
"type": "reporter",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded rules (or, in 0.11.0, lowercase frequencies or omitted RRULE prefixes) that expand per-second synchronously, blocking the shared event loop for minutes per request and on every scheduler poll."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:56.082Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-whgc-vpjx-m3qh)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-whgc-vpjx-m3qh"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.11.0-before-0.11.4-denial-of-service-via-automation-recurrence-rules"
}
],
"title": "Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109297",
"datePublished": "2026-10-12T16:04:56.082Z",
"dateReserved": "2026-10-12T14:13:39.026Z",
"dateUpdated": "2026-10-12T16:04:56.082Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109296 (GCVE-0-2026-109296)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:04 – Updated: 2026-10-12 16:04
VLAI
EPSS
VEX
Title
Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes
Summary
Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Ollama and OpenAI-compatible listing routes to trigger requests carrying configured API keys, read version strings, and enumerate connections.
Severity
4.3 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ahkarl13"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Ollama and OpenAI-compatible listing routes to trigger requests carrying configured API keys, read version strings, and enumerate connections."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:55.400Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-hm62-64q2-6gxw)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-hm62-64q2-6gxw"
},
{
"name": "VulnCheck Advisory: Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-before-0.11.4-missing-authorization-via-backend-index-on-model-routes"
}
],
"title": "Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109296",
"datePublished": "2026-10-12T16:04:55.400Z",
"dateReserved": "2026-10-12T14:12:52.833Z",
"dateUpdated": "2026-10-12T16:04:55.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109295 (GCVE-0-2026-109295)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:04 – Updated: 2026-10-13 18:09
VLAI
EPSS
VEX
Title
Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop
Summary
Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grep_knowledge_files or grep_chat_files with a catastrophically backtracking regex, blocking the event loop for two seconds per repeated call.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 18:08 UTC
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.11.0 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109295",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T18:08:41.758895Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:09:05.825Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-gfjp-5hc9-852r"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.11.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "yousif-IQ"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grep_knowledge_files or grep_chat_files with a catastrophically backtracking regex, blocking the event loop for two seconds per repeated call."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:54.739Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-gfjp-5hc9-852r)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-gfjp-5hc9-852r"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.11.0-before-0.11.4-redos-via-grep-knowledge-files-event-loop"
}
],
"title": "Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109295",
"datePublished": "2026-10-12T16:04:54.739Z",
"dateReserved": "2026-10-12T14:12:52.833Z",
"dateUpdated": "2026-10-13T18:09:05.825Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109294 (GCVE-0-2026-109294)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:04 – Updated: 2026-10-13 16:55
VLAI
EPSS
VEX
Title
Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image
Summary
Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, which get_image_base64_from_url decompresses unbounded, causing denial of service for all users.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:49 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.6.42 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109294",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:49:06.873464Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:55:21.600Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.6.42",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.6.42",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "y4rvin"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, which get_image_base64_from_url decompresses unbounded, causing denial of service for all users."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:54.107Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-w8j8-jv6j-3m47)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-w8j8-jv6j-3m47"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.6.42-before-0.11.4-memory-exhaustion-via-compressed-remote-image"
}
],
"title": "Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109294",
"datePublished": "2026-10-12T16:04:54.107Z",
"dateReserved": "2026-10-12T14:12:52.833Z",
"dateUpdated": "2026-10-13T16:55:21.600Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109293 (GCVE-0-2026-109293)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:04 – Updated: 2026-10-13 15:44
VLAI
EPSS
VEX
Title
Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint
Summary
Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of read-only shared tools, exposing embedded API keys and credentials.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:43 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.11.0 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109293",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:43:50.350400Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:44:47.679Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-2h26-836q-4jh2"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.11.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "gigioneggiando"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of read-only shared tools, exposing embedded API keys and credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:53.493Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-2h26-836q-4jh2)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-2h26-836q-4jh2"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.11.0-before-0.11.4-tool-source-disclosure-via-tool-export-endpoint"
}
],
"title": "Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109293",
"datePublished": "2026-10-12T16:04:53.493Z",
"dateReserved": "2026-10-12T14:12:52.833Z",
"dateUpdated": "2026-10-13T15:44:47.679Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109292 (GCVE-0-2026-109292)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:04 – Updated: 2026-10-12 16:04
VLAI
EPSS
VEX
Title
Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections
Summary
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.
Severity
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://github.com/open-webui/open-webui/commit/f… | patch |
| https://github.com/open-webui/open-webui/commit/b… | patch |
| https://github.com/open-webui/open-webui/commit/3… | patch |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.6.27 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.6.27",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.6.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "gigioneggiando"
},
{
"lang": "en",
"type": "reporter",
"value": "brodmart"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:52.925Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-gqfh-jxvw-74rp)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-gqfh-jxvw-74rp"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/open-webui/open-webui/commit/f9f815c86220f809fad5ee1300c44f55dea74c79"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/open-webui/open-webui/commit/b71744b17823f7a3a9a64cb363e79a7164ed5b23"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/open-webui/open-webui/commit/3cda47cdb449aac970426f0929c9e5f8bb8bd807"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.6.27-before-0.11.4-session-token-disclosure-via-oauth-mode-connections"
}
],
"title": "Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109292",
"datePublished": "2026-10-12T16:04:52.925Z",
"dateReserved": "2026-10-12T14:12:52.833Z",
"dateUpdated": "2026-10-12T16:04:52.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109291 (GCVE-0-2026-109291)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:04 – Updated: 2026-10-12 16:04
VLAI
EPSS
VEX
Title
Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url
Summary
Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embed_url fields. Attackers can share a crafted chat whose citation, when clicked, is passed to window.open, letting them steal localStorage.token and act as the victim.
Severity
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.6.33 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.6.33",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.6.33",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zyakir13"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims\u0027 sessions by storing javascript: URLs in citation embed_url fields. Attackers can share a crafted chat whose citation, when clicked, is passed to window.open, letting them steal localStorage.token and act as the victim."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:52.313Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-qpqv-xwg8-cqpj)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-qpqv-xwg8-cqpj"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.6.33-before-0.11.4-stored-xss-via-citation-embed-url"
}
],
"title": "Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109291",
"datePublished": "2026-10-12T16:04:52.313Z",
"dateReserved": "2026-10-12T14:12:52.833Z",
"dateUpdated": "2026-10-12T16:04:52.313Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}