What is the CVSS score of CVE-2026-26193?

CVE-2026-26193 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of AI / ML are affected by CVE-2026-26193?

CVE-2026-26193 is a high-severity vulnerability affecting Open WebUI deployments that could allow unauthorized access or data compromise on self-hosted AI platforms.

Is there a public PoC exploit available for CVE-2026-26193?

Yes, a public proof-of-concept exploit is available for CVE-2026-26193. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-26193?

Within 24 hours: Inventory all Open WebUI instances and document their network exposure and data classification. Within 7 days: Implement network segmentation to restrict Open WebUI access to authorized users only and deploy WAF rules to block known exploit patterns. Within 30 days: Establish a vendor communication channel for patch availability updates and conduct a risk assessment to determine if Open WebUI should remain in production or be temporarily decommissioned pending patch release.

AI / ML CVE-2026-26193

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-19 security-advisories@github.com

XSS AI / ML Open Webui

7.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

PoC Detected

Feb 20, 2026 - 20:15 vuln.today

Public exploit code

CVE Published

Feb 19, 2026 - 20:25 nvd

HIGH 7.3

DescriptionGitHub Advisory

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.44, aanually modifying chat history allows setting the embeds property on a response message, the content of which is loaded into an iFrame with a sandbox that has allow-scripts and allow-same-origin set, ignoring the "iframe Sandbox Allow Same Origin" configuration. This enables stored XSS on the affected chat. This also triggers when the chat is in the shared format. The result is a shareable link containing the payload that can be distributed to any other users on the instance. Version 0.6.44 fixes the issue.

AnalysisAI

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. [CVSS 7.3 HIGH]

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate to Open WebUI

Delivery

Manually modify chat history to inject malicious embeds

Exploit

Craft iframe sandbox bypass payload

Execution

Trigger stored XSS when chat renders

Impact

Execute JavaScript in victim context