What is the CVSS score of CVE-2026-26193?

CVE-2026-26193 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of AI / ML are affected by CVE-2026-26193?

CVE-2026-26193 is a high-severity vulnerability affecting Open WebUI deployments that could allow unauthorized access or data compromise on self-hosted AI platforms.. A patch is available.

Is there a public PoC exploit available for CVE-2026-26193?

Yes, a public proof-of-concept exploit is available for CVE-2026-26193. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-26193?

Within 24 hours: Inventory all Open WebUI instances and document their network exposure and data classification. Within 7 days: Implement network segmentation to restrict Open WebUI access to authorized users only and deploy WAF rules to block known exploit patterns. Within 30 days: Establish a vendor communication channel for patch availability updates and conduct a risk assessment to determine if Open WebUI should remain in production or be temporarily decommissioned pending patch release.

AI / ML CVE-2026-26193

EUVD-2026-7981 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-19 security-advisories@github.com

GHSA-vjm7-m4xh-7wrc

XSS AI / ML Open Webui

7.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 07, 2026 - 18:01 EUVD

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

PoC Detected

Feb 20, 2026 - 20:15 vuln.today

Public exploit code

CVE Published

Feb 19, 2026 - 20:25 nvd

HIGH 7.3

DescriptionGitHub Advisory

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.44, aanually modifying chat history allows setting the embeds property on a response message, the content of which is loaded into an iFrame with a sandbox that has allow-scripts and allow-same-origin set, ignoring the "iframe Sandbox Allow Same Origin" configuration. This enables stored XSS on the affected chat. This also triggers when the chat is in the shared format. The result is a shareable link containing the payload that can be distributed to any other users on the instance. Version 0.6.44 fixes the issue.

AnalysisAI

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. [CVSS 7.3 HIGH]

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Open Webui. Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.44, aanually modifying chat history allows setting the embeds property on a response message, the content of which is loaded into an iFrame with a sandbox that has allow-scripts and allow-same-origin set, ignoring the "iframe Sandbox Allow Same Origin" configuration. This enables stored XSS on the affected chat. This also triggers when the chat is in the shared format. Th

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.