Open Webui
Monthly
Authenticated low-privilege users of Open WebUI versions 0.8.6 up to but not including 0.11.4 can escalate privileges through the terminal proxy endpoint /api/v1/terminals/{server_id}/{path}, which forwards requests to the backend Terminals administrator API with the shared key attached; by targeting admin paths directly, an attacker can enumerate and stop other users' terminals, modify terminal policies, and inject environment variables into other users' sessions. The flaw is a missing-authorization (CWE-862) path-confusion issue reachable by any account with PR:L and no user interaction, and it only matters where the terminals feature is enabled against configured terminal servers in a multi-user deployment. No public exploit code has been identified at time of analysis and the issue is not tied to any confirmed active exploitation, but the vendor has shipped a fix and the independent assessment rates this as a genuine, moderate-priority risk rather than an emergency.
Denial of service in Open WebUI 0.9.0 through 0.11.3 lets an authenticated user who holds the operator-granted 'automations' permission stall the whole instance by submitting recurrence rules that are syntactically valid but unsatisfiable - the canonical example being a rule that resolves to a nonexistent date such as February 30th - to the automations create or update endpoints. Each submitted rule blocks the single shared async event loop for several seconds, so repeated requests degrade or halt service for all users; impact is availability-only, with no data exposure or code execution, and the instance recovers once the requests stop. The vulnerability is scored 7.1 (CVSS 4.0 AV:N/AC:L/PR:L, and 7.1 under CVSS 3.1 with A:H) and there is no public exploit identified at time of analysis, though a vendor-released fix (0.11.4) is available.
Authenticated users of Open WebUI 0.11.0 through 0.11.3 can crash or stall the backend by submitting short nested-repetition regex patterns to the built-in knowledge and chat file search tools (grep_knowledge_files, grep_chat_files), which compile the attacker-controlled pattern with a backtracking regex engine whose nested counted repetition expands without bound at compile time and is then cached. The result is a blocked event loop and exhausted worker memory - a pure availability impact (CVSS 4.0 7.1, AV:N/AC:L/AT:N/PR:L/UI:N/VA:H, CWE-400) with no confidentiality or integrity loss; the flaw sits in the default regex compilation path, so default installs of the affected versions are exposed rather than only a non-default feature. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has shipped a fix in Open WebUI 0.11.4 that replaces the engine with RE2.
Denial of service in Open WebUI 0.11.0 through 0.11.3 lets authenticated users who are permitted to create automations submit crafted recurrence rules that expand on a per-second basis, synchronously blocking the shared event loop for minutes per request and again on every scheduler poll. The root cause is a mismatch in strictness: the sub-daily frequency guard in the recurrence-rule validator parses rule text more strictly than the calendar library that actually executes it, so whitespace-folded rules (or, on 0.11.0 specifically, lowercase frequency keywords or omitted RRULE prefixes) slip past the guard yet still execute. The flaw is availability-only (CVE-2026-109297, CWE-400, CVSS 7.1) and authentication-gated; no public exploit code was identified at time of analysis and it is not confirmed actively exploited (not in CISA KEV), with patched builds available in 0.11.4.
Authenticated users of Open WebUI 0.11.0 through 0.11.3 can stall server workers by getting the model to call the grep_knowledge_files or grep_chat_files file-search tools with a catastrophically backtracking regular expression, which blocks the async event loop for roughly two seconds on each repeated invocation. Exploitation requires a valid account with access to those tools (CVSS PR:L), so unauthenticated attackers cannot trigger it directly; the practical exposure is highest on multi-tenant, shared-account, or self-service-registration instances where untrusted users already hold logins. There is no public exploit identified at time of analysis, and the effect is transient availability degradation that must be sustained by repeated calls rather than a one-shot outage (CVSS 4.0 base 7.1; CVSS 3.1 A:H with no confidentiality or integrity impact).
Memory exhaustion in Open WebUI 0.6.42 through 0.11.3 allows an authenticated user to take the entire instance offline for all users by submitting a chat message whose image field points to an attacker-controlled host that returns a gzip-encoded HTTP response. Because get_image_base64_from_url decompresses remote image responses without any size limit, a small compressed payload expands into an arbitrary amount of heap memory and drives the server into an out-of-memory denial of service. Exploitation requires a valid account and the ability to post chat messages (PR:L per the CVSS vector), and the independent assessment rates the impact as availability-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), moderate severity rather than critical; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Information disclosure in Open WebUI 0.11.0 through 0.11.3 allows an authenticated non-admin user who holds the tool export permission to retrieve the complete Python source code of tools shared with them in read-only mode by calling GET /api/v1/tools/export, exposing any API keys or credentials embedded in that source. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the impact is bounded by three prerequisites: a valid account, the specific tool export permission, and the presence of read-only shared tools that actually contain secrets. The issue is rated CVSS 4.0 7.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) and is fixed in 0.11.4.
Open WebUI versions 0.6.27 through 0.11.3 forward the entire browser cookie jar - session cookies included - to OpenAI-compatible connections, OpenAPI tool servers, and terminal servers that are configured in OAuth mode, letting the operator of such a destination server capture those cookies from routine requests and replay them to hijack accounts, including administrators. The issue is unauthenticated from the attacker's perspective (CVSS 4.0 7.6; independently assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N), but it is constrained: the attacker must control or monitor an endpoint an administrator has deliberately connected to, and a victim user must route a request through that connection. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV); a vendor-released patch exists in 0.11.4.
Stored cross-site scripting in Open WebUI versions from 0.6.33 up to (but not including) 0.11.4 lets an authenticated user embed a javascript: URL in a citation's embed_url field inside a chat, then share that chat so that when the victim clicks the citation the URL is handed to window.open. Successful exploitation executes script in the victim's browser session, allowing theft of localStorage.token and full account takeover as the victim. The attacker must already hold a valid account (PR:L) and the victim must actively click the crafted citation (UI:P), so exposure is limited to instances where chat sharing is enabled and users interact with untrusted shared content; no public exploit code or CISA KEV entry was identified at time of analysis, and the vendor fix is released in 0.11.4.
Stored cross-site scripting in Open WebUI 0.11.1 through 0.11.3 lets any authenticated user who can upload chat attachments plant malicious script inside a DOCX file, which then executes in the browser of a higher-privileged user who previews it - typically an administrator. The injected code can read the administrator's session token from browser local storage and hand it to the attacker, resulting in full takeover of the instance. Exploitation requires a valid low-privileged account plus an admin voluntarily opening the attachment preview, so it is a credible, above-average-priority issue rather than an emergency; no public exploit code has been identified at time of analysis, and no confirmed active exploitation (no CISA KEV listing) has been reported. Fixed in 0.11.4.
Stored cross-site scripting in Open WebUI versions before 0.11.4 allows an authenticated user to plant a markdown link using a javascript: scheme inside a shared chat; when a second user opens that chat and clicks the link, the script executes in the victim's browser session and can exfiltrate the JWT held in local storage - including an administrator's token. Exploitation requires a valid low-privilege account plus the chat-sharing feature and, critically, a click by the targeted victim, so this is best characterized as a targeted social-engineering risk rather than an unauthenticated mass-exploitation issue. No public exploit code or confirmed active exploitation was identified at time of analysis, and the independent assessment rates this a credible, moderately serious risk rather than a top-tier emergency.
Session token theft in Open WebUI 0.7.0 through 0.11.3 lets any website a signed-in user visits post an unvalidated 'verify:chat' message that the SyncStatsModal component accepts without checking the sender's origin, ultimately returning the victim's JWT and granting full API access to their account. The attack is client-side and remote, scoring 8.6 (CVSS 4.0) and independently assessed at CVSS 3.1 8.x severity (AV:N/AC:L/PR:N/UI:R, C:H/I:H); it requires no server-side authentication, but does require that the victim hold a live session and interact with an attacker-controlled page. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a fix in 0.11.4.
Server-side request forgery in Open WebUI prior to 0.11.1 allows authenticated users to reach internal cloud infrastructure by exploiting gaps in Python's `is_global` address classification. The web retrieval endpoints POST /api/v1/retrieval/process/web and /process/web/search relied solely on Python's built-in global-address check, which does not reject the Azure platform channel IP (168.63.129.16) or other reserved ranges such as multicast, 6to4 relay, NAT64, IPv6 site-local, and embedded-IPv4 representations. On Azure-hosted deployments this enables exfiltration of platform metadata, certificates, and management tokens accessible via the wire-link channel. No public exploit identified at time of analysis; vendor-released patch exists as version 0.11.1.
Improper privilege management in Open WebUI 0.10.0 through 0.11.0 allows any authenticated low-privilege user with write access to a knowledge base to delete administrator-owned external connection configurations shared across the entire instance. The DELETE /api/v1/knowledge/{id}/delete endpoint in knowledge.py correctly validated the user's write access to their own knowledge base but then cascaded the delete to the underlying shared external connection without verifying admin role or checking whether other knowledge bases depended on that connection. This means a single non-admin user can render all other knowledge bases on the instance that share the same external vector store connection permanently unavailable. No public exploit has been identified at time of analysis; vendor-released patch is available in version 0.11.1.
DNS rebinding SSRF in Open WebUI versions 0.9.6 through 0.11.0 allows authenticated users who control authoritative DNS to bypass hostname validation in SafePlaywrightURLLoader and reach internal services or cloud metadata endpoints. The flaw exists because Python validates the resolved hostname at check time, then the Playwright browser independently re-resolves the same hostname at use time - enabling an attacker to serve a public IP during validation and a private or link-local IP for the actual fetch. The issue is fixed in v0.11.1 by routing all fetches through the SSRF-safe requests session, eliminating the second resolution. No public exploit code or CISA KEV listing is present.
Stored cross-site scripting in Open WebUI's terminal port preview feature allows an authenticated attacker sharing a terminal server with a victim to execute arbitrary JavaScript in the victim's browser at the Open WebUI origin, enabling full account takeover. The vulnerability affects versions 0.8.11 through 0.11.1 and stems from a dangerous iframe sandbox configuration that combines `allow-scripts` with `allow-same-origin`, which together nullify sandbox isolation when content is served from the application's own origin. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed, but the attack is straightforward for any authenticated user on a shared terminal deployment.
OAuth and SCIM identity confusion in Open WebUI 0.6.41-0.10.x (SQLite-backed deployments only) allows unauthenticated remote attackers to hijack arbitrary stored user accounts, including administrator accounts, by presenting an OAuth subject claim containing SQL LIKE wildcard characters. SQLAlchemy's `JSON.contains()` on SQLite compiles to a substring LIKE match rather than an exact equality check, so a crafted `sub` claim such as `%admin%` can resolve to a different stored identity and cause the server to issue the attacker a valid session token for that identity. Vendor-released patch is available in version 0.11.1; no active exploitation has been confirmed.
Denial of service in Open WebUI versions 0.9.0-0.11.0 allows unauthenticated remote attackers to stall the application server and amplify traffic to the configured identity provider by submitting requests to the backchannel-logout OAuth endpoint. The handler fetches the OIDC discovery document and signing keys on every inbound request-including invalid ones-before performing any token validation; additionally, the original synchronous PyJWKClient call blocks the asyncio event loop, so each malicious request can render the single-worker instance unresponsive. No public exploit code has been identified at time of analysis; the issue is fixed in version 0.11.1.
Remote code execution in Open WebUI (self-hosted LLM interface) before the fixed 0.3.33 release allows attackers to hijack an authenticated admin session through a CORS misconfiguration. When an instance is deployed with allow_origins=* and an authenticated admin visits an attacker-controlled website, the malicious page can issue authenticated cross-origin requests to the /api/v1/functions endpoint and register attacker-supplied Python code, achieving code execution - and because the container runs as root by default, full container compromise. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the flaw is documented in a GitHub Security Lab advisory (GHSL-2024-174/175) and reported by VulnCheck.
Stored cross-site scripting in Open WebUI before 0.9.5 lets an attacker plant a malicious SVG as a victim's OAuth profile image and execute script in the application's origin. During OAuth login, the `picture` claim URL is fetched and its MIME type is guessed from the file extension rather than the response Content-Type, so a `.svg` URL is stored as a `data:image/svg+xml;base64,...` URI that bypasses the profile-image allowlist; when an authenticated user opens the profile image endpoint the SVG is served inline with no default CSP, running JavaScript that reads `localStorage.token` for account takeover. Reported by VulnCheck with a detailed GHSA source-code advisory; no public exploit identified at time of analysis and it is not in CISA KEV.
Path traversal in Open WebUI's terminal proxy (versions 0.9.6 through 0.9.x, fixed in 0.10.0) lets an authenticated attacker reach files and resources outside the intended proxy scope. The _sanitize_proxy_path routine in backend/open_webui/routers/terminals.py decoded incoming proxy paths exactly eight times, so a nine-times percent-encoded ../ sequence survived normalization and was decoded a final time by the upstream terminal server, defeating the traversal check. No public exploit or CISA KEV listing exists at time of analysis, but the scope-changing CVSS 3.1 score of 7.7 (S:C/C:H) signals meaningful confidentiality impact on the backend terminal component.
Identity spoofing in Open WebUI before 0.10.0 lets an authenticated low-privileged user impersonate another account by injecting query parameters into the terminal WebSocket URL. Because backend/open_webui/routers/terminals.py built the ws_terminal upstream URL from an unencoded session_id and appended user_id as a query parameter - while the HTTP proxy path trusted an integrity-unbound X-User-Id header - an attacker can make the terminal backend resolve a different user identity, gaining that victim's terminal session context. No public exploit has been identified at time of analysis, but the fix is confirmed in v0.10.0 and the flaw is scored CVSS 8.0.
Session revocation bypass in Open WebUI 0.9.0 through 0.9.x (deployments configured with Redis) lets a holder of a revoked JWT keep authenticating realtime Socket.IO connections. The flaw stems from first-message authentication for Socket.IO connect, user-join, join-channels, join-note, and the terminal websocket calling decode_token without the Redis-backed is_valid_token revocation check, so logout, forced-logout, or token invalidation does not sever active realtime access. No public exploit is identified at time of analysis and it is not listed in CISA KEV; the fix is version 0.10.0.
Cross-user remote code execution in Open WebUI before 0.10.0 lets an authenticated user run arbitrary code interpreter Python or invoke tools inside another logged-in user's session. The get_event_call handler dispatched execute:python and execute:tool Socket.IO events to any client-supplied session_id that was merely 'connected', so an attacker who harvested a victim's socket ID via the ydoc:document:join collaboration flow could hijack that session. A proof-of-concept is indicated in the SSVC data, though the flaw is not in CISA KEV and EPSS rates near-term mass exploitation low (0.28%, 19th percentile).
Privilege escalation and server-side code execution in Open WebUI before 0.10.0 lets a low-privileged authenticated user plant a malicious chat payload that, when a victim (typically an admin) clicks Run, executes client-side Python via Pyodide in a same-origin web worker and issues authenticated same-origin requests to admin-only endpoints. Because the requests inherit the victim's session, the attacker can reach administrative APIs and trigger server-side code execution through configured tools. No public exploit has been identified at time of analysis, and EPSS is low (0.25%), but CVSS is 9.0 with total technical impact per CISA SSVC.
Broken access control in Open WebUI allows authenticated users to access tool values across tenant boundaries, exposing sensitive information from other users' AI tool configurations. The vulnerability affects self-hosted Open WebUI instances prior to version 0.8.11. With CVSS 7.7 (High) and network-accessible attack vector requiring only low-privilege authentication, this represents a significant confidentiality breach in multi-tenant deployments. No public exploit identified at time of analysis, with EPSS data not yet available for this recent CVE.
Open WebUI versions prior to 0.8.6 permit authenticated users to overwrite arbitrary file contents through an insecure batch processing endpoint, escalating read-only knowledge base access to write permissions without ownership validation. Attackers with low-level privileges can manipulate RAG (Retrieval-Augmented Generation) content served to language models, poisoning AI responses delivered to other users. CVSS 7.1 (High) reflects network-accessible exploitation with low complexity requiring only standard user authentication; no public exploit identified at time of analysis.
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. [CVSS 7.3 HIGH]
Stored XSS in Open WebUI prior to version 0.7.0 allows authenticated users to inject malicious HTML payloads into chat document metadata, which execute in the browser when citations are previewed or viewed in shared chats. Public exploit code exists for this vulnerability, and an attacker with login access can compromise any user who interacts with their weaponized chat documents. Upgrade to version 0.7.0 or later to remediate.
Remote code execution in Open WebUI through the load_tool_module_by_id function allows authenticated attackers to execute arbitrary Python code due to insufficient input validation on user-supplied strings. An attacker with valid credentials can leverage this vulnerability to achieve code execution with service account privileges. No patch is currently available, making this a critical risk for deployed Open WebUI instances.
Remote code execution in Open WebUI's install_frontmatter_requirements function allows authenticated attackers to execute arbitrary commands on the host system by bypassing input validation in system call parameters. The vulnerability affects AI/ML deployments using Open WebUI and requires valid authentication credentials to exploit. No patch is currently available.
Stored cross-site scripting (XSS) in Open WebUI versions 0.6.31 up to but not including 0.11.4 allows authenticated users to inject malicious JavaScript via crafted Markdown tool-call details blocks whose embeds attribute is mounted in script-enabled iframes. A victim passively viewing the crafted channel message, chat message, or citation content can be subjected to in-app phishing or, if the non-default iframeSandboxAllowSameOrigin option is enabled, session hijacking. This moderate-severity vulnerability (CVSS 4.0 base 5.1) has no public exploit identified at time of analysis and requires a valid account plus victim interaction.
Authenticated users on Open WebUI instances running versions earlier than 0.11.4 can bypass administrator-imposed restrictions and reach model provider backends that have been explicitly disabled, by supplying an explicit backend index as a path segment or query parameter on the Ollama and OpenAI-compatible model listing routes. The issue is an IDOR/missing-authorization flaw (CWE-639) that discloses backend version strings, enumerates configured connections, and causes server-side requests to carry previously stored API keys - although the keys are used in outbound calls rather than necessarily returned in plaintext, and there is no integrity or availability impact. It is a medium-severity information-disclosure issue (CVSS 4.0 base 5.3; assessed CVSS 3.1 5.3) requiring a valid account (PR:L) plus at least one configured backend, and no public exploit code has been identified at time of analysis.
Improper session revocation in Open WebUI 0.8.8 through 0.11.4 allows an authenticated user whose account has been deactivated to continue executing terminal commands and reading or writing files on the terminal server through an already-established terminal WebSocket. The terminal proxy route in terminals.py validates access only on the first WebSocket message and never re-checks it, so the deactivated session persists until the socket is closed; the attacker cannot open a new session after deactivation, and PR:L in the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) confirms prior valid access to the terminal feature is required. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, making this a moderate privilege-persistence flaw rather than a high-impact remote code execution issue.
Open WebUI versions 0.9.6 through 0.11.3 allow an authenticated user who holds read access to any single knowledge base to probe the file-listing endpoint GET /api/v1/knowledge/{id}/files with a directory UUID belonging to a different knowledge base, and the response breadcrumbs disclose folder names, owner user IDs and knowledge base IDs for that directory and all of its ancestors. The flaw is an authenticated tenant-to-tenant metadata leak (CVSS 3.1 base 5.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) - credentials are mandatory, file contents are not exposed, and the attack requires possession of a valid foreign directory UUID, which the advisory characterizes as a previously retained identifier rather than a guessable or sequential value. No public exploit code or active exploitation has been identified at time of analysis, and the primary remediation is upgrading to 0.11.4 or later.
Former collaborators on Open WebUI knowledge bases can keep downloading or deleting files they were previously granted access to, because the has_access_to_file authorization check evaluates a stale cached knowledge base reference after the collaborator has been removed. The flaw affects Open WebUI 0.6.0 through the release immediately preceding 0.11.4, and is only reachable by an authenticated user who previously held a read or write grant on a specific knowledge base and then lost it - a share-then-revoke lifecycle - so single-owner or never-shared knowledge bases are unaffected; impact is confined to file download and deletion inside Open WebUI, including files in the owner's private knowledge bases. Rated low severity (CVSS 4.0 base 2.3; independent assessment CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L), with no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) - a genuinely low-priority issue despite the 'Authentication Bypass' tag.
Improper authorization in Open WebUI 0.11.0 through 0.11.3 allows an authenticated user who is a member of a shared folder to insert attacker-controlled chats into that folder by calling POST /api/v1/chats/{id}/fork on chats they created there while they still held write access, even after being downgraded to read-only. The endpoint places the forked chat in the source chat's folder without re-checking the caller's current write permission on that folder (CWE-862), so the injected content becomes visible to the folder owner and other members. Exploitation is not opportunistic: it requires a valid account, a non-default multi-member shared folder, and the specific stateful precondition that the attacker's own chats were created before the downgrade; impact is confined to integrity (content insertion) with no disclosure or availability effect, and no public exploit code has been identified at time of analysis.
Authorization bypass in Open WebUI 0.11.1 through 0.11.3 allows an authenticated user with a linked OAuth account to retain their previous role after their identity provider role is downgraded or revoked, provided the provider sends role claims only in the ID token and not in the userinfo response. The vulnerability resides in the OAuth token exchange endpoint, which does not demote the user's existing role when no roles claim is found in userinfo. No public exploit has been identified, and impact is limited to retaining an already-held role rather than gaining new privileges.
Open WebUI versions 0.8.0 through 0.11.0 contain an authorization bypass in the OAuth token exchange endpoint that allows users to obtain valid sessions without triggering the role management logic enforced by the normal OAuth login callback. Users whose identity provider roles would cause Open WebUI to deny or demote them on standard login can instead present a provider access token directly to the `/token_exchange` endpoint and receive a session at their existing (unauthorized) role level. Fixed in v0.11.1; no public exploit identified at time of analysis.
Open WebUI's OAuth token exchange endpoint (present in versions 0.8.0 through 0.8.x) bypasses the `OAUTH_ALLOWED_DOMAINS` email domain allowlist that the normal OAuth login callback enforces, allowing a user whose domain was removed from the allowlist to continue obtaining valid sessions via the alternate endpoint. The flaw is rooted in code duplication: the token exchange endpoint re-implemented identity lookup but omitted the authorization policy checks present in the primary callback. No public exploit is identified at time of analysis; vendor-released patch is available in 0.9.0.
Infinite-loop denial-of-service in Open WebUI 0.5.0-0.11.0 allows any authenticated user to permanently crash the backend service by storing id-less messages in a cyclic parent chain. The flaw in `get_message_list` (backend/open_webui/utils/misc.py) caused the chat-history traversal to never terminate, blocking the async event loop and consuming memory until the process died - with the condition persisting across restarts until an operator manually removes the offending messages or upgrades. No public exploit or active exploitation has been identified, but the low barrier (any login) and persistence across restarts make this an operationally impactful issue for self-hosted deployments.
SSRF filter-bypass in Open WebUI 0.9.5-0.11.0 allows authenticated users to route server-side fetches to private networks, loopback addresses, and cloud metadata endpoints by exploiting unvalidated HTTP redirect destinations. When AIOHTTP_CLIENT_ALLOW_REDIRECTS is enabled, the platform applies WEB_FETCH_FILTER_LIST and private-address controls only to the initial request URL, not to redirect hops - allowing a crafted redirect chain to reach AWS IMDS, Azure platform channels, or internal services. No public exploit exists and the issue is not in CISA KEV, but the scope-changed CVSS vector (S:C) and potential exposure of cloud IAM credentials in hosted deployments elevate practical risk above the 5.0 base score.
Denial-of-service in Open WebUI versions 0.10.0 through 0.11.0 allows any authenticated user to permanently block all server-side request processing by submitting a cyclic chat message tree and then triggering the message-deletion endpoint. The DELETE /api/v1/chats/{id}/messages/{message_id} API delegates to a Python helper that traverses childrenIds in a while loop without recording visited node identifiers, entering an infinite loop that occupies the server's request thread indefinitely until the process is forcibly killed. No active exploitation or KEV listing is recorded, but the attack requires only a valid user session and no special configuration, making it a credible insider or compromised-credential threat for any multi-user deployment. Vendor-released patch is available in version 0.11.1.
Folder write-access bypass in Open WebUI 0.10.0 through 0.11.0 allows authenticated users to inject chats into shared folders where they hold only read-only or no write permission. The chat completion endpoints POST /api/chat/completions and POST /api/v1/chat/completions in main.py accepted a client-supplied folder_id from request metadata and persisted the resulting chat record under that folder without invoking the has_folder_write_access check that the dedicated chat-creation routes enforced. No public exploit or CISA KEV listing has been identified at time of analysis; the vendor confirmed the fix in v0.11.1.
Message authorship is not verified in Open WebUI's chat_completion endpoint (versions 0.9.5-0.11.0), allowing any authenticated channel member with write access to silently overwrite another member's messages while the victim remains listed as the stored author. The flaw is an IDOR-class authorization failure (CWE-639) in backend/open_webui/main.py: the channel branch checked channel membership and write permission but never validated that the requesting user owned the targeted message_id. Fixed in v0.11.1; no public exploit has been identified at time of analysis.
Information disclosure in Open WebUI 0.7.0-0.10.x allows authenticated low-privilege users to enumerate the identifiers, names, and descriptions of knowledge bases they are not authorized to access. The built-in knowledge search tool constructed a metadata filter restricting results to the caller's readable collections, but all eleven shipped vector-store backends (Elasticsearch, Milvus, Milvus Multitenancy, OpenGauss, and others) silently ignored that filter during search execution. No public exploit has been identified at time of analysis; the vendor released a fix in v0.11.1 confirmed by GitHub Security Advisory GHSA-pcvc-8vrv-8q6w.
Session cookie leakage in Open WebUI versions 0.6.27 through 0.11.0 allows an attacker who operates a connected tool server to capture a victim user's Open WebUI session cookies and achieve full account takeover. The root cause is a Python closure-in-loop bug in tools.py where a shared cookie jar from the enclosing async loop was captured by all tool callable functions instead of being bound per-function; when a session- or OAuth-authenticated tool server was processed last in the initialization loop, its cookies were incorrectly propagated into requests directed at other attached servers. Vendor-released patch version 0.11.1 is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Insufficient session expiration in Open WebUI 0.9.0-0.11.0 allows a demoted administrator to retain full read and write access to all users' collaborative notes by keeping an existing Socket.IO connection open after their role is revoked. The flaw exists because role updates applied through trusted role headers, OAuth role mapping, or SCIM provisioning write the new role to the database but do not invalidate the stale user record cached in the Socket.IO SESSION_POOL. The vulnerability is fixed in version 0.11.1; no public exploit code has been identified at time of analysis.
Infinite CPU and memory exhaustion in Open WebUI 0.10.0-0.11.0 allows any authenticated user to trigger a persistent server-side denial of service by exploiting missing cycle detection in the folder tree API. The folder parent-update endpoint accepted self-referential or descendant-referential reparenting requests, storing a circular linked structure in the database. Subsequent folder operations - delete and read traversals - followed parent pointers indefinitely, consuming server resources until the cycle was manually repaired in the database. No public exploit code beyond the patch PR has been identified at time of analysis.
Calendar alert suppression in Open WebUI versions 0.9.0 through 0.11.0 allows an authenticated low-privileged user to permanently disable reminder notifications instance-wide by storing a non-numeric `alert_minutes` value in a calendar event. The flaw in `backend/open_webui/models/calendar.py` causes the shared upcoming-event scheduler to raise an unhandled exception when it attempts numeric comparison on the unvalidated user-controlled field, aborting the entire alert pass and silencing reminders for every user while the malicious event remains in the lookahead window. No public exploit code or active exploitation has been identified; vendor-released patch version 0.11.1 resolves the issue.
DNS rebinding bypasses Open WebUI's SSRF protection in all versions prior to 0.11.0, enabling authenticated attackers who control authoritative DNS for a submitted hostname to reach internal resources - including cloud instance metadata services (e.g., 169.254.169.254), loopback admin APIs, and internal network services. The root cause is a TOCTOU race: the hostname is resolved once for validation and again at connection time, letting a TTL=0 DNS record switch from a public IP during the check to an internal IP during the actual fetch. On most vulnerable paths the internal response is returned directly to the attacker; the OAuth path additionally forwards the OAuth access token as a Bearer header to the attacker-controlled internal target, enabling credential theft. No public exploit identified at time of analysis.
Cross-knowledge-base IDOR in Open WebUI 0.9.6-0.10.2 allows any user with write access to one knowledge base to silently delete directories and file embeddings from unrelated knowledge bases they do not control, causing documents to vanish from RAG retrieval results and breaking chat-with-file for targeted files without disclosing their contents. The flaw (CWE-639) sits in the sync cleanup endpoint, which authorized requests based on the URL knowledge base ID but executed destructive operations against object IDs supplied in the request body without verifying those objects belonged to the authorized knowledge base. No public exploit is identified and no CISA KEV listing exists; the vendor released a complete fix in v0.11.0.
Cross-user file content disclosure in Open WebUI versions 0.8.8 through 0.10.2 allows any authenticated user to read indexed chunks from another user's private files by supplying a crafted inline model definition with a known target file UUID. The chat completion, chat completed, and chat action endpoints accepted client-supplied knowledge attachments on inline (non-workspace) model definitions without enforcing the caller's read access, bypassing the access control that saved workspace models correctly enforce. No active exploitation has been confirmed; the vendor released a complete fix in version 0.11.0.
The terminal file-preview feature in Open WebUI 0.9.0 through 0.10.2 allows an authenticated attacker with access to a configured terminal server to execute arbitrary scripts in the application's own browser origin by exploiting a hardcoded iframe sandbox misconfiguration, enabling full session token theft and account takeover. The `serveUrl` iframe branch unconditionally combined `allow-same-origin` with `allow-scripts` for HTML files served from the application's own domain, completely negating iframe sandbox isolation regardless of user settings. In the highest-impact scenario, if the victim holds admin privileges or `workspace.functions`, the account takeover extends to server-side code execution on the Open WebUI host. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; a vendor patch is available in version 0.11.0.
Open WebUI versions 0.8.12 through 0.9.x expose a missing authorization flaw that permits authenticated non-admin users to reach restricted underlying AI models by exploiting a code-path divergence in task endpoints. The standard chat route (/api/v1/chat/completions) correctly re-validates submodel access after arena wrapper resolution, but task endpoints such as /api/v1/tasks/moa/completions call utils.chat.generate_chat_completion() directly, triggering arena fallback resolution after the wrapper check passes and recursing with bypass_filter=True - effectively nullifying the submodel access control. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the attack requires only low-privilege authentication (PR:L), making it directly relevant to any multi-tenant or enterprise Open WebUI deployment with model access tiering.
Open WebUI's WEB_FETCH_FILTER_LIST blocklist enforcement fails to parse hostnames at label boundaries in versions prior to 0.10.0, enabling authenticated users to bypass administrator-configured host restrictions and trigger server-side fetches to internally restricted resources. Two bypass classes exist: embedding a blocked hostname in the URL path component (e.g., https://attacker.com/internal.corp/data) rather than the authority, and using a sibling domain sharing the blocked entry's suffix (e.g., evilinternalhost.example.com matching a blocklist entry for internalhost.example.com). No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Information disclosure in Open WebUI versions 0.7.0 through 0.9.x allows authenticated channel members to retrieve sensitive administrator settings, including API keys for tool servers and webhook configurations. The /api/v1/channels/{id}/members endpoint fails to sanitize user model responses, exposing full UserModel data to any participant in a shared channel. A public proof-of-concept exists, but active exploitation is not confirmed and the EPSS probability of widespread exploitation is low (0.26%).
File upload authorization bypass in Open WebUI before 0.10.0 allows authenticated users with read-only knowledge base access to inject arbitrary files into restricted knowledge bases by supplying a crafted metadata.knowledge_id parameter. The upload endpoint omits the write-access check enforced by the dedicated /api/v1/knowledge/<id>/file/add route (CWE-862), creating a privilege escalation path for any authenticated platform user. No public exploit code or CISA KEV listing exists at time of analysis, but the impact extends beyond the low CVSS integrity score - injected content directly influences LLM responses for all users of the affected knowledge base, enabling indirect prompt injection.
Cross-channel thread context disclosure in Open WebUI prior to 0.10.0 allows authenticated low-privilege users to reference messages from private or DM channels they do not have access to, leaking thread content across channel boundaries. The root cause is a missing channel-binding validation on the parent_id parameter in thread reply handling - the server does not verify that the referenced parent message belongs to the channel specified in the URL. No public exploit or active exploitation has been identified; this is a low-severity, high-complexity authorization bypass with confirmed vendor fix in v0.10.0.
Cache key misconfiguration in Open WebUI versions 0.6.27 through 0.9.x leaks permission-filtered model lists across authenticated users during the aiocache TTL window. The flaw exists in both the OpenAI and Ollama router handlers, where a lambda was incorrectly passed as the cache key instead of a per-user key_builder, collapsing all users into a single shared cache entry. An authenticated attacker on a shared instance can receive a different user's model list - revealing which AI models that user has access to - with no public exploit identified at time of analysis and a vendor-released patch available in v0.10.0.
Incorrect authorization in Open WebUI versions 0.9.6 through 0.9.x allows authenticated users with read-only knowledge file access to escalate their privileges to file write or delete operations. The root cause is that `_verify_knowledge_file_access` validated only read permissions, while write and delete routes independently trusted access derived from writable model `meta.knowledge` entries - creating a logical gap where the authorization check and the actual enforcement were misaligned. No public exploit or CISA KEV listing is identified at time of analysis; this is a medium-severity, authenticated-only issue fixed in v0.10.0.
Unauthenticated manipulation of collaborative document state is possible in Open WebUI versions 0.6.16 through 0.9.x, where the Socket.IO server's always_connect=True configuration allows the ydoc:awareness:update and ydoc:document:leave event handlers to process requests from any connected client regardless of identity. An attacker with network access to the platform can inject false collaborative presence data or trigger spurious document-leave events, disrupting active collaboration sessions for legitimate users. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in the input.
Regular expression denial of service in Open WebUI 0.9.2-0.9.x allows any authenticated user to block the Python asyncio event loop by sending a single malformed chat message. The SKILL_MENTION_RE and strip_re patterns in middleware.py use overlapping quantifiers when parsing skill-mention syntax, causing quadratic backtracking on input containing '<$' without a closing '>'. Because the event loop is synchronously blocked, the attack effectively takes the entire Open WebUI instance offline for all concurrent users. No public exploit code or active exploitation has been identified at time of analysis; the fix is confirmed in the v0.10.0 release.
Improper authorization in Open WebUI 0.9.x allows deactivated or pending users to continue executing scheduled AI model automations after their accounts should have lost that capability. The `execute_automation` function rehydrated automation owners without re-verifying that the owner account was still active or still held the `features.automations` permission, and `check_model_access` enforced private-model grants only against the current user role at the time of check rather than re-validating eligibility at execution time. No public exploit has been identified at time of analysis, and the CVSS score of 3.1 reflects the low real-world severity: high attack complexity, limited availability impact, and no confidentiality or integrity impact per the official assessment.
Open WebUI versions 0.8.11 through 0.10.0 expose a missing-authorization flaw (CWE-862) on the POST /api/v1/images/edit endpoint, allowing any verified non-admin account to invoke server-side image editing even when administrators have disabled the global image-edit switch or revoked per-user image-generation permissions. The bypass enables unprivileged users to consume admin-configured third-party image provider credentials - exhausting API quotas or generating unauthorized images - undermining deliberate access controls set by the platform operator. No public exploit has been identified at time of analysis; a vendor-confirmed fix is available in version 0.10.0.
Timing-based account enumeration in Open WebUI prior to 0.10.0 exposes whether any given email address is registered on a self-hosted AI instance. The /api/v1/auths/signin endpoint only invokes bcrypt password verification when a matching email record exists, making registered-account login attempts measurably slower than attempts against unregistered emails - a classic CWE-208 timing oracle. Unauthenticated remote attackers can exploit this discrepancy at scale to harvest valid account emails, which can then fuel credential stuffing or targeted phishing. No public exploit code or CISA KEV listing has been identified, and the vendor has released a fix in v0.10.0.
Server-side request forgery in Open WebUI before 0.6.27 enables authenticated users to bypass SSRF protections in the web retrieval endpoint by supplying URLs that trigger server-side HTTP redirects to internal network resources. The /api/v1/retrieval/process/web endpoint follows Location redirect headers without revalidating the destination against SSRF blocklists, exposing internal services and potentially instance secrets that could enable command execution. No public exploit code or active exploitation has been identified at time of analysis, but the authenticated escalation path to internal infrastructure warrants prompt patching.
Blind Server-Side Request Forgery in Open WebUI 0.7.2 and below allows authenticated remote attackers to scan the local network and infer open ports via the image editing prompt functionality, which performs unrestricted GET requests to user-supplied URLs. The vulnerability enables port enumeration of internal network services without exposing response content, potentially leading to reconnaissance of locally accessible services. No public exploit code or active exploitation has been confirmed; patch status remains unresolved at time of publication.
Open WebUI versions prior to 0.8.6 allow authenticated users to read other users' private memories through an insufficiently restricted API endpoint at `/api/v1/retrieval/query/collection`, exposing sensitive user data stored within the self-hosted AI platform. The vulnerability requires valid authentication credentials and carries a CVSS score of 3.1 with low attack complexity, indicating limited real-world exploitability despite the information disclosure impact. No public exploit code or active exploitation has been confirmed at the time of analysis.
Open WebUI versions prior to 0.8.6 allow authenticated users to delete arbitrary files from knowledge bases they have write access to, due to missing validation that files actually belong to the target knowledge base. An attacker with legitimate write permissions to any knowledge base can exploit this to delete files from other knowledge bases by crafting requests with known file identifiers, resulting in data loss and service disruption. No public exploit code or active exploitation has been reported at time of analysis.
Open WebUI versions prior to 0.8.6 disclose the server's absolute DATA_DIR path to any authenticated non-admin user via unsanitized filename handling in the speech-to-text transcription endpoint, which returns FileNotFoundError messages in HTTP 400 responses. This information disclosure affects all default deployments and requires only user-level authentication to trigger. The vulnerability has been patched in version 0.8.6, and no public exploit code or active exploitation has been identified at time of analysis.
Open WebUI transmits authentication credentials in cleartext over the network, enabling adjacent attackers to intercept and obtain sensitive information without authentication. This information disclosure vulnerability can facilitate unauthorized access and further compromise of affected systems. No patch is currently available.
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Stored XSS vulnerability was discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing them to execute arbitrary JavaScript code and steal session tokens when a victim downloads the note as PDF. This vulnerability can be exploited by any authenticated user, and unauthenticated external attackers can steal session tokens from users (both admin and regular users) by sharing specially crafted markdown files. This vulnerability is fixed in 0.6.37.
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. No special permissions beyond basic authentication are required. This vulnerability is fixed in 0.6.37.
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers (a normal user) to stop arbitrary LLM response tasks.
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
open-webui v0.5.16 is vulnerable to SSRF in routers/ollama.py in function verify_connection. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the HTML for tooltips. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authenticated low-privilege users of Open WebUI versions 0.8.6 up to but not including 0.11.4 can escalate privileges through the terminal proxy endpoint /api/v1/terminals/{server_id}/{path}, which forwards requests to the backend Terminals administrator API with the shared key attached; by targeting admin paths directly, an attacker can enumerate and stop other users' terminals, modify terminal policies, and inject environment variables into other users' sessions. The flaw is a missing-authorization (CWE-862) path-confusion issue reachable by any account with PR:L and no user interaction, and it only matters where the terminals feature is enabled against configured terminal servers in a multi-user deployment. No public exploit code has been identified at time of analysis and the issue is not tied to any confirmed active exploitation, but the vendor has shipped a fix and the independent assessment rates this as a genuine, moderate-priority risk rather than an emergency.
Denial of service in Open WebUI 0.9.0 through 0.11.3 lets an authenticated user who holds the operator-granted 'automations' permission stall the whole instance by submitting recurrence rules that are syntactically valid but unsatisfiable - the canonical example being a rule that resolves to a nonexistent date such as February 30th - to the automations create or update endpoints. Each submitted rule blocks the single shared async event loop for several seconds, so repeated requests degrade or halt service for all users; impact is availability-only, with no data exposure or code execution, and the instance recovers once the requests stop. The vulnerability is scored 7.1 (CVSS 4.0 AV:N/AC:L/PR:L, and 7.1 under CVSS 3.1 with A:H) and there is no public exploit identified at time of analysis, though a vendor-released fix (0.11.4) is available.
Authenticated users of Open WebUI 0.11.0 through 0.11.3 can crash or stall the backend by submitting short nested-repetition regex patterns to the built-in knowledge and chat file search tools (grep_knowledge_files, grep_chat_files), which compile the attacker-controlled pattern with a backtracking regex engine whose nested counted repetition expands without bound at compile time and is then cached. The result is a blocked event loop and exhausted worker memory - a pure availability impact (CVSS 4.0 7.1, AV:N/AC:L/AT:N/PR:L/UI:N/VA:H, CWE-400) with no confidentiality or integrity loss; the flaw sits in the default regex compilation path, so default installs of the affected versions are exposed rather than only a non-default feature. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has shipped a fix in Open WebUI 0.11.4 that replaces the engine with RE2.
Denial of service in Open WebUI 0.11.0 through 0.11.3 lets authenticated users who are permitted to create automations submit crafted recurrence rules that expand on a per-second basis, synchronously blocking the shared event loop for minutes per request and again on every scheduler poll. The root cause is a mismatch in strictness: the sub-daily frequency guard in the recurrence-rule validator parses rule text more strictly than the calendar library that actually executes it, so whitespace-folded rules (or, on 0.11.0 specifically, lowercase frequency keywords or omitted RRULE prefixes) slip past the guard yet still execute. The flaw is availability-only (CVE-2026-109297, CWE-400, CVSS 7.1) and authentication-gated; no public exploit code was identified at time of analysis and it is not confirmed actively exploited (not in CISA KEV), with patched builds available in 0.11.4.
Authenticated users of Open WebUI 0.11.0 through 0.11.3 can stall server workers by getting the model to call the grep_knowledge_files or grep_chat_files file-search tools with a catastrophically backtracking regular expression, which blocks the async event loop for roughly two seconds on each repeated invocation. Exploitation requires a valid account with access to those tools (CVSS PR:L), so unauthenticated attackers cannot trigger it directly; the practical exposure is highest on multi-tenant, shared-account, or self-service-registration instances where untrusted users already hold logins. There is no public exploit identified at time of analysis, and the effect is transient availability degradation that must be sustained by repeated calls rather than a one-shot outage (CVSS 4.0 base 7.1; CVSS 3.1 A:H with no confidentiality or integrity impact).
Memory exhaustion in Open WebUI 0.6.42 through 0.11.3 allows an authenticated user to take the entire instance offline for all users by submitting a chat message whose image field points to an attacker-controlled host that returns a gzip-encoded HTTP response. Because get_image_base64_from_url decompresses remote image responses without any size limit, a small compressed payload expands into an arbitrary amount of heap memory and drives the server into an out-of-memory denial of service. Exploitation requires a valid account and the ability to post chat messages (PR:L per the CVSS vector), and the independent assessment rates the impact as availability-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), moderate severity rather than critical; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Information disclosure in Open WebUI 0.11.0 through 0.11.3 allows an authenticated non-admin user who holds the tool export permission to retrieve the complete Python source code of tools shared with them in read-only mode by calling GET /api/v1/tools/export, exposing any API keys or credentials embedded in that source. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the impact is bounded by three prerequisites: a valid account, the specific tool export permission, and the presence of read-only shared tools that actually contain secrets. The issue is rated CVSS 4.0 7.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) and is fixed in 0.11.4.
Open WebUI versions 0.6.27 through 0.11.3 forward the entire browser cookie jar - session cookies included - to OpenAI-compatible connections, OpenAPI tool servers, and terminal servers that are configured in OAuth mode, letting the operator of such a destination server capture those cookies from routine requests and replay them to hijack accounts, including administrators. The issue is unauthenticated from the attacker's perspective (CVSS 4.0 7.6; independently assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N), but it is constrained: the attacker must control or monitor an endpoint an administrator has deliberately connected to, and a victim user must route a request through that connection. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV); a vendor-released patch exists in 0.11.4.
Stored cross-site scripting in Open WebUI versions from 0.6.33 up to (but not including) 0.11.4 lets an authenticated user embed a javascript: URL in a citation's embed_url field inside a chat, then share that chat so that when the victim clicks the citation the URL is handed to window.open. Successful exploitation executes script in the victim's browser session, allowing theft of localStorage.token and full account takeover as the victim. The attacker must already hold a valid account (PR:L) and the victim must actively click the crafted citation (UI:P), so exposure is limited to instances where chat sharing is enabled and users interact with untrusted shared content; no public exploit code or CISA KEV entry was identified at time of analysis, and the vendor fix is released in 0.11.4.
Stored cross-site scripting in Open WebUI 0.11.1 through 0.11.3 lets any authenticated user who can upload chat attachments plant malicious script inside a DOCX file, which then executes in the browser of a higher-privileged user who previews it - typically an administrator. The injected code can read the administrator's session token from browser local storage and hand it to the attacker, resulting in full takeover of the instance. Exploitation requires a valid low-privileged account plus an admin voluntarily opening the attachment preview, so it is a credible, above-average-priority issue rather than an emergency; no public exploit code has been identified at time of analysis, and no confirmed active exploitation (no CISA KEV listing) has been reported. Fixed in 0.11.4.
Stored cross-site scripting in Open WebUI versions before 0.11.4 allows an authenticated user to plant a markdown link using a javascript: scheme inside a shared chat; when a second user opens that chat and clicks the link, the script executes in the victim's browser session and can exfiltrate the JWT held in local storage - including an administrator's token. Exploitation requires a valid low-privilege account plus the chat-sharing feature and, critically, a click by the targeted victim, so this is best characterized as a targeted social-engineering risk rather than an unauthenticated mass-exploitation issue. No public exploit code or confirmed active exploitation was identified at time of analysis, and the independent assessment rates this a credible, moderately serious risk rather than a top-tier emergency.
Session token theft in Open WebUI 0.7.0 through 0.11.3 lets any website a signed-in user visits post an unvalidated 'verify:chat' message that the SyncStatsModal component accepts without checking the sender's origin, ultimately returning the victim's JWT and granting full API access to their account. The attack is client-side and remote, scoring 8.6 (CVSS 4.0) and independently assessed at CVSS 3.1 8.x severity (AV:N/AC:L/PR:N/UI:R, C:H/I:H); it requires no server-side authentication, but does require that the victim hold a live session and interact with an attacker-controlled page. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a fix in 0.11.4.
Server-side request forgery in Open WebUI prior to 0.11.1 allows authenticated users to reach internal cloud infrastructure by exploiting gaps in Python's `is_global` address classification. The web retrieval endpoints POST /api/v1/retrieval/process/web and /process/web/search relied solely on Python's built-in global-address check, which does not reject the Azure platform channel IP (168.63.129.16) or other reserved ranges such as multicast, 6to4 relay, NAT64, IPv6 site-local, and embedded-IPv4 representations. On Azure-hosted deployments this enables exfiltration of platform metadata, certificates, and management tokens accessible via the wire-link channel. No public exploit identified at time of analysis; vendor-released patch exists as version 0.11.1.
Improper privilege management in Open WebUI 0.10.0 through 0.11.0 allows any authenticated low-privilege user with write access to a knowledge base to delete administrator-owned external connection configurations shared across the entire instance. The DELETE /api/v1/knowledge/{id}/delete endpoint in knowledge.py correctly validated the user's write access to their own knowledge base but then cascaded the delete to the underlying shared external connection without verifying admin role or checking whether other knowledge bases depended on that connection. This means a single non-admin user can render all other knowledge bases on the instance that share the same external vector store connection permanently unavailable. No public exploit has been identified at time of analysis; vendor-released patch is available in version 0.11.1.
DNS rebinding SSRF in Open WebUI versions 0.9.6 through 0.11.0 allows authenticated users who control authoritative DNS to bypass hostname validation in SafePlaywrightURLLoader and reach internal services or cloud metadata endpoints. The flaw exists because Python validates the resolved hostname at check time, then the Playwright browser independently re-resolves the same hostname at use time - enabling an attacker to serve a public IP during validation and a private or link-local IP for the actual fetch. The issue is fixed in v0.11.1 by routing all fetches through the SSRF-safe requests session, eliminating the second resolution. No public exploit code or CISA KEV listing is present.
Stored cross-site scripting in Open WebUI's terminal port preview feature allows an authenticated attacker sharing a terminal server with a victim to execute arbitrary JavaScript in the victim's browser at the Open WebUI origin, enabling full account takeover. The vulnerability affects versions 0.8.11 through 0.11.1 and stems from a dangerous iframe sandbox configuration that combines `allow-scripts` with `allow-same-origin`, which together nullify sandbox isolation when content is served from the application's own origin. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed, but the attack is straightforward for any authenticated user on a shared terminal deployment.
OAuth and SCIM identity confusion in Open WebUI 0.6.41-0.10.x (SQLite-backed deployments only) allows unauthenticated remote attackers to hijack arbitrary stored user accounts, including administrator accounts, by presenting an OAuth subject claim containing SQL LIKE wildcard characters. SQLAlchemy's `JSON.contains()` on SQLite compiles to a substring LIKE match rather than an exact equality check, so a crafted `sub` claim such as `%admin%` can resolve to a different stored identity and cause the server to issue the attacker a valid session token for that identity. Vendor-released patch is available in version 0.11.1; no active exploitation has been confirmed.
Denial of service in Open WebUI versions 0.9.0-0.11.0 allows unauthenticated remote attackers to stall the application server and amplify traffic to the configured identity provider by submitting requests to the backchannel-logout OAuth endpoint. The handler fetches the OIDC discovery document and signing keys on every inbound request-including invalid ones-before performing any token validation; additionally, the original synchronous PyJWKClient call blocks the asyncio event loop, so each malicious request can render the single-worker instance unresponsive. No public exploit code has been identified at time of analysis; the issue is fixed in version 0.11.1.
Remote code execution in Open WebUI (self-hosted LLM interface) before the fixed 0.3.33 release allows attackers to hijack an authenticated admin session through a CORS misconfiguration. When an instance is deployed with allow_origins=* and an authenticated admin visits an attacker-controlled website, the malicious page can issue authenticated cross-origin requests to the /api/v1/functions endpoint and register attacker-supplied Python code, achieving code execution - and because the container runs as root by default, full container compromise. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the flaw is documented in a GitHub Security Lab advisory (GHSL-2024-174/175) and reported by VulnCheck.
Stored cross-site scripting in Open WebUI before 0.9.5 lets an attacker plant a malicious SVG as a victim's OAuth profile image and execute script in the application's origin. During OAuth login, the `picture` claim URL is fetched and its MIME type is guessed from the file extension rather than the response Content-Type, so a `.svg` URL is stored as a `data:image/svg+xml;base64,...` URI that bypasses the profile-image allowlist; when an authenticated user opens the profile image endpoint the SVG is served inline with no default CSP, running JavaScript that reads `localStorage.token` for account takeover. Reported by VulnCheck with a detailed GHSA source-code advisory; no public exploit identified at time of analysis and it is not in CISA KEV.
Path traversal in Open WebUI's terminal proxy (versions 0.9.6 through 0.9.x, fixed in 0.10.0) lets an authenticated attacker reach files and resources outside the intended proxy scope. The _sanitize_proxy_path routine in backend/open_webui/routers/terminals.py decoded incoming proxy paths exactly eight times, so a nine-times percent-encoded ../ sequence survived normalization and was decoded a final time by the upstream terminal server, defeating the traversal check. No public exploit or CISA KEV listing exists at time of analysis, but the scope-changing CVSS 3.1 score of 7.7 (S:C/C:H) signals meaningful confidentiality impact on the backend terminal component.
Identity spoofing in Open WebUI before 0.10.0 lets an authenticated low-privileged user impersonate another account by injecting query parameters into the terminal WebSocket URL. Because backend/open_webui/routers/terminals.py built the ws_terminal upstream URL from an unencoded session_id and appended user_id as a query parameter - while the HTTP proxy path trusted an integrity-unbound X-User-Id header - an attacker can make the terminal backend resolve a different user identity, gaining that victim's terminal session context. No public exploit has been identified at time of analysis, but the fix is confirmed in v0.10.0 and the flaw is scored CVSS 8.0.
Session revocation bypass in Open WebUI 0.9.0 through 0.9.x (deployments configured with Redis) lets a holder of a revoked JWT keep authenticating realtime Socket.IO connections. The flaw stems from first-message authentication for Socket.IO connect, user-join, join-channels, join-note, and the terminal websocket calling decode_token without the Redis-backed is_valid_token revocation check, so logout, forced-logout, or token invalidation does not sever active realtime access. No public exploit is identified at time of analysis and it is not listed in CISA KEV; the fix is version 0.10.0.
Cross-user remote code execution in Open WebUI before 0.10.0 lets an authenticated user run arbitrary code interpreter Python or invoke tools inside another logged-in user's session. The get_event_call handler dispatched execute:python and execute:tool Socket.IO events to any client-supplied session_id that was merely 'connected', so an attacker who harvested a victim's socket ID via the ydoc:document:join collaboration flow could hijack that session. A proof-of-concept is indicated in the SSVC data, though the flaw is not in CISA KEV and EPSS rates near-term mass exploitation low (0.28%, 19th percentile).
Privilege escalation and server-side code execution in Open WebUI before 0.10.0 lets a low-privileged authenticated user plant a malicious chat payload that, when a victim (typically an admin) clicks Run, executes client-side Python via Pyodide in a same-origin web worker and issues authenticated same-origin requests to admin-only endpoints. Because the requests inherit the victim's session, the attacker can reach administrative APIs and trigger server-side code execution through configured tools. No public exploit has been identified at time of analysis, and EPSS is low (0.25%), but CVSS is 9.0 with total technical impact per CISA SSVC.
Broken access control in Open WebUI allows authenticated users to access tool values across tenant boundaries, exposing sensitive information from other users' AI tool configurations. The vulnerability affects self-hosted Open WebUI instances prior to version 0.8.11. With CVSS 7.7 (High) and network-accessible attack vector requiring only low-privilege authentication, this represents a significant confidentiality breach in multi-tenant deployments. No public exploit identified at time of analysis, with EPSS data not yet available for this recent CVE.
Open WebUI versions prior to 0.8.6 permit authenticated users to overwrite arbitrary file contents through an insecure batch processing endpoint, escalating read-only knowledge base access to write permissions without ownership validation. Attackers with low-level privileges can manipulate RAG (Retrieval-Augmented Generation) content served to language models, poisoning AI responses delivered to other users. CVSS 7.1 (High) reflects network-accessible exploitation with low complexity requiring only standard user authentication; no public exploit identified at time of analysis.
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. [CVSS 7.3 HIGH]
Stored XSS in Open WebUI prior to version 0.7.0 allows authenticated users to inject malicious HTML payloads into chat document metadata, which execute in the browser when citations are previewed or viewed in shared chats. Public exploit code exists for this vulnerability, and an attacker with login access can compromise any user who interacts with their weaponized chat documents. Upgrade to version 0.7.0 or later to remediate.
Remote code execution in Open WebUI through the load_tool_module_by_id function allows authenticated attackers to execute arbitrary Python code due to insufficient input validation on user-supplied strings. An attacker with valid credentials can leverage this vulnerability to achieve code execution with service account privileges. No patch is currently available, making this a critical risk for deployed Open WebUI instances.
Remote code execution in Open WebUI's install_frontmatter_requirements function allows authenticated attackers to execute arbitrary commands on the host system by bypassing input validation in system call parameters. The vulnerability affects AI/ML deployments using Open WebUI and requires valid authentication credentials to exploit. No patch is currently available.
Stored cross-site scripting (XSS) in Open WebUI versions 0.6.31 up to but not including 0.11.4 allows authenticated users to inject malicious JavaScript via crafted Markdown tool-call details blocks whose embeds attribute is mounted in script-enabled iframes. A victim passively viewing the crafted channel message, chat message, or citation content can be subjected to in-app phishing or, if the non-default iframeSandboxAllowSameOrigin option is enabled, session hijacking. This moderate-severity vulnerability (CVSS 4.0 base 5.1) has no public exploit identified at time of analysis and requires a valid account plus victim interaction.
Authenticated users on Open WebUI instances running versions earlier than 0.11.4 can bypass administrator-imposed restrictions and reach model provider backends that have been explicitly disabled, by supplying an explicit backend index as a path segment or query parameter on the Ollama and OpenAI-compatible model listing routes. The issue is an IDOR/missing-authorization flaw (CWE-639) that discloses backend version strings, enumerates configured connections, and causes server-side requests to carry previously stored API keys - although the keys are used in outbound calls rather than necessarily returned in plaintext, and there is no integrity or availability impact. It is a medium-severity information-disclosure issue (CVSS 4.0 base 5.3; assessed CVSS 3.1 5.3) requiring a valid account (PR:L) plus at least one configured backend, and no public exploit code has been identified at time of analysis.
Improper session revocation in Open WebUI 0.8.8 through 0.11.4 allows an authenticated user whose account has been deactivated to continue executing terminal commands and reading or writing files on the terminal server through an already-established terminal WebSocket. The terminal proxy route in terminals.py validates access only on the first WebSocket message and never re-checks it, so the deactivated session persists until the socket is closed; the attacker cannot open a new session after deactivation, and PR:L in the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) confirms prior valid access to the terminal feature is required. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, making this a moderate privilege-persistence flaw rather than a high-impact remote code execution issue.
Open WebUI versions 0.9.6 through 0.11.3 allow an authenticated user who holds read access to any single knowledge base to probe the file-listing endpoint GET /api/v1/knowledge/{id}/files with a directory UUID belonging to a different knowledge base, and the response breadcrumbs disclose folder names, owner user IDs and knowledge base IDs for that directory and all of its ancestors. The flaw is an authenticated tenant-to-tenant metadata leak (CVSS 3.1 base 5.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) - credentials are mandatory, file contents are not exposed, and the attack requires possession of a valid foreign directory UUID, which the advisory characterizes as a previously retained identifier rather than a guessable or sequential value. No public exploit code or active exploitation has been identified at time of analysis, and the primary remediation is upgrading to 0.11.4 or later.
Former collaborators on Open WebUI knowledge bases can keep downloading or deleting files they were previously granted access to, because the has_access_to_file authorization check evaluates a stale cached knowledge base reference after the collaborator has been removed. The flaw affects Open WebUI 0.6.0 through the release immediately preceding 0.11.4, and is only reachable by an authenticated user who previously held a read or write grant on a specific knowledge base and then lost it - a share-then-revoke lifecycle - so single-owner or never-shared knowledge bases are unaffected; impact is confined to file download and deletion inside Open WebUI, including files in the owner's private knowledge bases. Rated low severity (CVSS 4.0 base 2.3; independent assessment CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L), with no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) - a genuinely low-priority issue despite the 'Authentication Bypass' tag.
Improper authorization in Open WebUI 0.11.0 through 0.11.3 allows an authenticated user who is a member of a shared folder to insert attacker-controlled chats into that folder by calling POST /api/v1/chats/{id}/fork on chats they created there while they still held write access, even after being downgraded to read-only. The endpoint places the forked chat in the source chat's folder without re-checking the caller's current write permission on that folder (CWE-862), so the injected content becomes visible to the folder owner and other members. Exploitation is not opportunistic: it requires a valid account, a non-default multi-member shared folder, and the specific stateful precondition that the attacker's own chats were created before the downgrade; impact is confined to integrity (content insertion) with no disclosure or availability effect, and no public exploit code has been identified at time of analysis.
Authorization bypass in Open WebUI 0.11.1 through 0.11.3 allows an authenticated user with a linked OAuth account to retain their previous role after their identity provider role is downgraded or revoked, provided the provider sends role claims only in the ID token and not in the userinfo response. The vulnerability resides in the OAuth token exchange endpoint, which does not demote the user's existing role when no roles claim is found in userinfo. No public exploit has been identified, and impact is limited to retaining an already-held role rather than gaining new privileges.
Open WebUI versions 0.8.0 through 0.11.0 contain an authorization bypass in the OAuth token exchange endpoint that allows users to obtain valid sessions without triggering the role management logic enforced by the normal OAuth login callback. Users whose identity provider roles would cause Open WebUI to deny or demote them on standard login can instead present a provider access token directly to the `/token_exchange` endpoint and receive a session at their existing (unauthorized) role level. Fixed in v0.11.1; no public exploit identified at time of analysis.
Open WebUI's OAuth token exchange endpoint (present in versions 0.8.0 through 0.8.x) bypasses the `OAUTH_ALLOWED_DOMAINS` email domain allowlist that the normal OAuth login callback enforces, allowing a user whose domain was removed from the allowlist to continue obtaining valid sessions via the alternate endpoint. The flaw is rooted in code duplication: the token exchange endpoint re-implemented identity lookup but omitted the authorization policy checks present in the primary callback. No public exploit is identified at time of analysis; vendor-released patch is available in 0.9.0.
Infinite-loop denial-of-service in Open WebUI 0.5.0-0.11.0 allows any authenticated user to permanently crash the backend service by storing id-less messages in a cyclic parent chain. The flaw in `get_message_list` (backend/open_webui/utils/misc.py) caused the chat-history traversal to never terminate, blocking the async event loop and consuming memory until the process died - with the condition persisting across restarts until an operator manually removes the offending messages or upgrades. No public exploit or active exploitation has been identified, but the low barrier (any login) and persistence across restarts make this an operationally impactful issue for self-hosted deployments.
SSRF filter-bypass in Open WebUI 0.9.5-0.11.0 allows authenticated users to route server-side fetches to private networks, loopback addresses, and cloud metadata endpoints by exploiting unvalidated HTTP redirect destinations. When AIOHTTP_CLIENT_ALLOW_REDIRECTS is enabled, the platform applies WEB_FETCH_FILTER_LIST and private-address controls only to the initial request URL, not to redirect hops - allowing a crafted redirect chain to reach AWS IMDS, Azure platform channels, or internal services. No public exploit exists and the issue is not in CISA KEV, but the scope-changed CVSS vector (S:C) and potential exposure of cloud IAM credentials in hosted deployments elevate practical risk above the 5.0 base score.
Denial-of-service in Open WebUI versions 0.10.0 through 0.11.0 allows any authenticated user to permanently block all server-side request processing by submitting a cyclic chat message tree and then triggering the message-deletion endpoint. The DELETE /api/v1/chats/{id}/messages/{message_id} API delegates to a Python helper that traverses childrenIds in a while loop without recording visited node identifiers, entering an infinite loop that occupies the server's request thread indefinitely until the process is forcibly killed. No active exploitation or KEV listing is recorded, but the attack requires only a valid user session and no special configuration, making it a credible insider or compromised-credential threat for any multi-user deployment. Vendor-released patch is available in version 0.11.1.
Folder write-access bypass in Open WebUI 0.10.0 through 0.11.0 allows authenticated users to inject chats into shared folders where they hold only read-only or no write permission. The chat completion endpoints POST /api/chat/completions and POST /api/v1/chat/completions in main.py accepted a client-supplied folder_id from request metadata and persisted the resulting chat record under that folder without invoking the has_folder_write_access check that the dedicated chat-creation routes enforced. No public exploit or CISA KEV listing has been identified at time of analysis; the vendor confirmed the fix in v0.11.1.
Message authorship is not verified in Open WebUI's chat_completion endpoint (versions 0.9.5-0.11.0), allowing any authenticated channel member with write access to silently overwrite another member's messages while the victim remains listed as the stored author. The flaw is an IDOR-class authorization failure (CWE-639) in backend/open_webui/main.py: the channel branch checked channel membership and write permission but never validated that the requesting user owned the targeted message_id. Fixed in v0.11.1; no public exploit has been identified at time of analysis.
Information disclosure in Open WebUI 0.7.0-0.10.x allows authenticated low-privilege users to enumerate the identifiers, names, and descriptions of knowledge bases they are not authorized to access. The built-in knowledge search tool constructed a metadata filter restricting results to the caller's readable collections, but all eleven shipped vector-store backends (Elasticsearch, Milvus, Milvus Multitenancy, OpenGauss, and others) silently ignored that filter during search execution. No public exploit has been identified at time of analysis; the vendor released a fix in v0.11.1 confirmed by GitHub Security Advisory GHSA-pcvc-8vrv-8q6w.
Session cookie leakage in Open WebUI versions 0.6.27 through 0.11.0 allows an attacker who operates a connected tool server to capture a victim user's Open WebUI session cookies and achieve full account takeover. The root cause is a Python closure-in-loop bug in tools.py where a shared cookie jar from the enclosing async loop was captured by all tool callable functions instead of being bound per-function; when a session- or OAuth-authenticated tool server was processed last in the initialization loop, its cookies were incorrectly propagated into requests directed at other attached servers. Vendor-released patch version 0.11.1 is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Insufficient session expiration in Open WebUI 0.9.0-0.11.0 allows a demoted administrator to retain full read and write access to all users' collaborative notes by keeping an existing Socket.IO connection open after their role is revoked. The flaw exists because role updates applied through trusted role headers, OAuth role mapping, or SCIM provisioning write the new role to the database but do not invalidate the stale user record cached in the Socket.IO SESSION_POOL. The vulnerability is fixed in version 0.11.1; no public exploit code has been identified at time of analysis.
Infinite CPU and memory exhaustion in Open WebUI 0.10.0-0.11.0 allows any authenticated user to trigger a persistent server-side denial of service by exploiting missing cycle detection in the folder tree API. The folder parent-update endpoint accepted self-referential or descendant-referential reparenting requests, storing a circular linked structure in the database. Subsequent folder operations - delete and read traversals - followed parent pointers indefinitely, consuming server resources until the cycle was manually repaired in the database. No public exploit code beyond the patch PR has been identified at time of analysis.
Calendar alert suppression in Open WebUI versions 0.9.0 through 0.11.0 allows an authenticated low-privileged user to permanently disable reminder notifications instance-wide by storing a non-numeric `alert_minutes` value in a calendar event. The flaw in `backend/open_webui/models/calendar.py` causes the shared upcoming-event scheduler to raise an unhandled exception when it attempts numeric comparison on the unvalidated user-controlled field, aborting the entire alert pass and silencing reminders for every user while the malicious event remains in the lookahead window. No public exploit code or active exploitation has been identified; vendor-released patch version 0.11.1 resolves the issue.
DNS rebinding bypasses Open WebUI's SSRF protection in all versions prior to 0.11.0, enabling authenticated attackers who control authoritative DNS for a submitted hostname to reach internal resources - including cloud instance metadata services (e.g., 169.254.169.254), loopback admin APIs, and internal network services. The root cause is a TOCTOU race: the hostname is resolved once for validation and again at connection time, letting a TTL=0 DNS record switch from a public IP during the check to an internal IP during the actual fetch. On most vulnerable paths the internal response is returned directly to the attacker; the OAuth path additionally forwards the OAuth access token as a Bearer header to the attacker-controlled internal target, enabling credential theft. No public exploit identified at time of analysis.
Cross-knowledge-base IDOR in Open WebUI 0.9.6-0.10.2 allows any user with write access to one knowledge base to silently delete directories and file embeddings from unrelated knowledge bases they do not control, causing documents to vanish from RAG retrieval results and breaking chat-with-file for targeted files without disclosing their contents. The flaw (CWE-639) sits in the sync cleanup endpoint, which authorized requests based on the URL knowledge base ID but executed destructive operations against object IDs supplied in the request body without verifying those objects belonged to the authorized knowledge base. No public exploit is identified and no CISA KEV listing exists; the vendor released a complete fix in v0.11.0.
Cross-user file content disclosure in Open WebUI versions 0.8.8 through 0.10.2 allows any authenticated user to read indexed chunks from another user's private files by supplying a crafted inline model definition with a known target file UUID. The chat completion, chat completed, and chat action endpoints accepted client-supplied knowledge attachments on inline (non-workspace) model definitions without enforcing the caller's read access, bypassing the access control that saved workspace models correctly enforce. No active exploitation has been confirmed; the vendor released a complete fix in version 0.11.0.
The terminal file-preview feature in Open WebUI 0.9.0 through 0.10.2 allows an authenticated attacker with access to a configured terminal server to execute arbitrary scripts in the application's own browser origin by exploiting a hardcoded iframe sandbox misconfiguration, enabling full session token theft and account takeover. The `serveUrl` iframe branch unconditionally combined `allow-same-origin` with `allow-scripts` for HTML files served from the application's own domain, completely negating iframe sandbox isolation regardless of user settings. In the highest-impact scenario, if the victim holds admin privileges or `workspace.functions`, the account takeover extends to server-side code execution on the Open WebUI host. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; a vendor patch is available in version 0.11.0.
Open WebUI versions 0.8.12 through 0.9.x expose a missing authorization flaw that permits authenticated non-admin users to reach restricted underlying AI models by exploiting a code-path divergence in task endpoints. The standard chat route (/api/v1/chat/completions) correctly re-validates submodel access after arena wrapper resolution, but task endpoints such as /api/v1/tasks/moa/completions call utils.chat.generate_chat_completion() directly, triggering arena fallback resolution after the wrapper check passes and recursing with bypass_filter=True - effectively nullifying the submodel access control. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the attack requires only low-privilege authentication (PR:L), making it directly relevant to any multi-tenant or enterprise Open WebUI deployment with model access tiering.
Open WebUI's WEB_FETCH_FILTER_LIST blocklist enforcement fails to parse hostnames at label boundaries in versions prior to 0.10.0, enabling authenticated users to bypass administrator-configured host restrictions and trigger server-side fetches to internally restricted resources. Two bypass classes exist: embedding a blocked hostname in the URL path component (e.g., https://attacker.com/internal.corp/data) rather than the authority, and using a sibling domain sharing the blocked entry's suffix (e.g., evilinternalhost.example.com matching a blocklist entry for internalhost.example.com). No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Information disclosure in Open WebUI versions 0.7.0 through 0.9.x allows authenticated channel members to retrieve sensitive administrator settings, including API keys for tool servers and webhook configurations. The /api/v1/channels/{id}/members endpoint fails to sanitize user model responses, exposing full UserModel data to any participant in a shared channel. A public proof-of-concept exists, but active exploitation is not confirmed and the EPSS probability of widespread exploitation is low (0.26%).
File upload authorization bypass in Open WebUI before 0.10.0 allows authenticated users with read-only knowledge base access to inject arbitrary files into restricted knowledge bases by supplying a crafted metadata.knowledge_id parameter. The upload endpoint omits the write-access check enforced by the dedicated /api/v1/knowledge/<id>/file/add route (CWE-862), creating a privilege escalation path for any authenticated platform user. No public exploit code or CISA KEV listing exists at time of analysis, but the impact extends beyond the low CVSS integrity score - injected content directly influences LLM responses for all users of the affected knowledge base, enabling indirect prompt injection.
Cross-channel thread context disclosure in Open WebUI prior to 0.10.0 allows authenticated low-privilege users to reference messages from private or DM channels they do not have access to, leaking thread content across channel boundaries. The root cause is a missing channel-binding validation on the parent_id parameter in thread reply handling - the server does not verify that the referenced parent message belongs to the channel specified in the URL. No public exploit or active exploitation has been identified; this is a low-severity, high-complexity authorization bypass with confirmed vendor fix in v0.10.0.
Cache key misconfiguration in Open WebUI versions 0.6.27 through 0.9.x leaks permission-filtered model lists across authenticated users during the aiocache TTL window. The flaw exists in both the OpenAI and Ollama router handlers, where a lambda was incorrectly passed as the cache key instead of a per-user key_builder, collapsing all users into a single shared cache entry. An authenticated attacker on a shared instance can receive a different user's model list - revealing which AI models that user has access to - with no public exploit identified at time of analysis and a vendor-released patch available in v0.10.0.
Incorrect authorization in Open WebUI versions 0.9.6 through 0.9.x allows authenticated users with read-only knowledge file access to escalate their privileges to file write or delete operations. The root cause is that `_verify_knowledge_file_access` validated only read permissions, while write and delete routes independently trusted access derived from writable model `meta.knowledge` entries - creating a logical gap where the authorization check and the actual enforcement were misaligned. No public exploit or CISA KEV listing is identified at time of analysis; this is a medium-severity, authenticated-only issue fixed in v0.10.0.
Unauthenticated manipulation of collaborative document state is possible in Open WebUI versions 0.6.16 through 0.9.x, where the Socket.IO server's always_connect=True configuration allows the ydoc:awareness:update and ydoc:document:leave event handlers to process requests from any connected client regardless of identity. An attacker with network access to the platform can inject false collaborative presence data or trigger spurious document-leave events, disrupting active collaboration sessions for legitimate users. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in the input.
Regular expression denial of service in Open WebUI 0.9.2-0.9.x allows any authenticated user to block the Python asyncio event loop by sending a single malformed chat message. The SKILL_MENTION_RE and strip_re patterns in middleware.py use overlapping quantifiers when parsing skill-mention syntax, causing quadratic backtracking on input containing '<$' without a closing '>'. Because the event loop is synchronously blocked, the attack effectively takes the entire Open WebUI instance offline for all concurrent users. No public exploit code or active exploitation has been identified at time of analysis; the fix is confirmed in the v0.10.0 release.
Improper authorization in Open WebUI 0.9.x allows deactivated or pending users to continue executing scheduled AI model automations after their accounts should have lost that capability. The `execute_automation` function rehydrated automation owners without re-verifying that the owner account was still active or still held the `features.automations` permission, and `check_model_access` enforced private-model grants only against the current user role at the time of check rather than re-validating eligibility at execution time. No public exploit has been identified at time of analysis, and the CVSS score of 3.1 reflects the low real-world severity: high attack complexity, limited availability impact, and no confidentiality or integrity impact per the official assessment.
Open WebUI versions 0.8.11 through 0.10.0 expose a missing-authorization flaw (CWE-862) on the POST /api/v1/images/edit endpoint, allowing any verified non-admin account to invoke server-side image editing even when administrators have disabled the global image-edit switch or revoked per-user image-generation permissions. The bypass enables unprivileged users to consume admin-configured third-party image provider credentials - exhausting API quotas or generating unauthorized images - undermining deliberate access controls set by the platform operator. No public exploit has been identified at time of analysis; a vendor-confirmed fix is available in version 0.10.0.
Timing-based account enumeration in Open WebUI prior to 0.10.0 exposes whether any given email address is registered on a self-hosted AI instance. The /api/v1/auths/signin endpoint only invokes bcrypt password verification when a matching email record exists, making registered-account login attempts measurably slower than attempts against unregistered emails - a classic CWE-208 timing oracle. Unauthenticated remote attackers can exploit this discrepancy at scale to harvest valid account emails, which can then fuel credential stuffing or targeted phishing. No public exploit code or CISA KEV listing has been identified, and the vendor has released a fix in v0.10.0.
Server-side request forgery in Open WebUI before 0.6.27 enables authenticated users to bypass SSRF protections in the web retrieval endpoint by supplying URLs that trigger server-side HTTP redirects to internal network resources. The /api/v1/retrieval/process/web endpoint follows Location redirect headers without revalidating the destination against SSRF blocklists, exposing internal services and potentially instance secrets that could enable command execution. No public exploit code or active exploitation has been identified at time of analysis, but the authenticated escalation path to internal infrastructure warrants prompt patching.
Blind Server-Side Request Forgery in Open WebUI 0.7.2 and below allows authenticated remote attackers to scan the local network and infer open ports via the image editing prompt functionality, which performs unrestricted GET requests to user-supplied URLs. The vulnerability enables port enumeration of internal network services without exposing response content, potentially leading to reconnaissance of locally accessible services. No public exploit code or active exploitation has been confirmed; patch status remains unresolved at time of publication.
Open WebUI versions prior to 0.8.6 allow authenticated users to read other users' private memories through an insufficiently restricted API endpoint at `/api/v1/retrieval/query/collection`, exposing sensitive user data stored within the self-hosted AI platform. The vulnerability requires valid authentication credentials and carries a CVSS score of 3.1 with low attack complexity, indicating limited real-world exploitability despite the information disclosure impact. No public exploit code or active exploitation has been confirmed at the time of analysis.
Open WebUI versions prior to 0.8.6 allow authenticated users to delete arbitrary files from knowledge bases they have write access to, due to missing validation that files actually belong to the target knowledge base. An attacker with legitimate write permissions to any knowledge base can exploit this to delete files from other knowledge bases by crafting requests with known file identifiers, resulting in data loss and service disruption. No public exploit code or active exploitation has been reported at time of analysis.
Open WebUI versions prior to 0.8.6 disclose the server's absolute DATA_DIR path to any authenticated non-admin user via unsanitized filename handling in the speech-to-text transcription endpoint, which returns FileNotFoundError messages in HTTP 400 responses. This information disclosure affects all default deployments and requires only user-level authentication to trigger. The vulnerability has been patched in version 0.8.6, and no public exploit code or active exploitation has been identified at time of analysis.
Open WebUI transmits authentication credentials in cleartext over the network, enabling adjacent attackers to intercept and obtain sensitive information without authentication. This information disclosure vulnerability can facilitate unauthorized access and further compromise of affected systems. No patch is currently available.
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Stored XSS vulnerability was discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing them to execute arbitrary JavaScript code and steal session tokens when a victim downloads the note as PDF. This vulnerability can be exploited by any authenticated user, and unauthenticated external attackers can steal session tokens from users (both admin and regular users) by sharing specially crafted markdown files. This vulnerability is fixed in 0.6.37.
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. No special permissions beyond basic authentication are required. This vulnerability is fixed in 0.6.37.
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers (a normal user) to stop arbitrary LLM response tasks.
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
open-webui v0.5.16 is vulnerable to SSRF in routers/ollama.py in function verify_connection. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the HTML for tooltips. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.