28
CVEs
1
Critical
12
High
0
KEV
17
PoC
2
Unpatched C/H
89.3%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
12
MEDIUM
13
LOW
2
Monthly CVE Trend
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-65959 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Stored XSS vulnerability was discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing them to execute arbitrary JavaScript code and steal session tokens when a victim downloads the note as PDF. This vulnerability can be exploited by any authenticated user, and unauthenticated external attackers can steal session tokens from users (both admin and regular users) by sharing specially crafted markdown files. This vulnerability is fixed in 0.6.37. | HIGH | 8.7 | 0.0% | 64 |
PoC
|
| CVE-2025-65958 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. No special permissions beyond basic authentication are required. This vulnerability is fixed in 0.6.37. | HIGH | 8.5 | 0.0% | 63 |
PoC
|
| CVE-2026-26192 | Stored XSS in Open WebUI prior to version 0.7.0 allows authenticated users to inject malicious HTML payloads into chat document metadata, which execute in the browser when citations are previewed or viewed in shared chats. Public exploit code exists for this vulnerability, and an attacker with login access can compromise any user who interacts with their weaponized chat documents. Upgrade to version 0.7.0 or later to remediate. | HIGH | 7.3 | 0.0% | 57 |
PoC
|
| CVE-2026-26193 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. [CVSS 7.3 HIGH] | HIGH | 7.3 | 0.0% | 57 |
PoC
|
| CVE-2026-88000 | Denial-of-service in Open WebUI versions 0.10.0 through 0.11.0 allows any authenticated user to permanently block all server-side request processing by submitting a cyclic chat message tree and then triggering the message-deletion endpoint. The DELETE /api/v1/chats/{id}/messages/{message_id} API delegates to a Python helper that traverses childrenIds in a while loop without recording visited node identifiers, entering an infinite loop that occupies the server's request thread indefinitely until the process is forcibly killed. No active exploitation or KEV listing is recorded, but the attack requires only a valid user session and no special configuration, making it a credible insider or compromised-credential threat for any multi-user deployment. Vendor-released patch is available in version 0.11.1. | MEDIUM | 6.5 | 0.3% | 53 |
PoC
|
| CVE-2026-88002 | Infinite-loop denial-of-service in Open WebUI 0.5.0-0.11.0 allows any authenticated user to permanently crash the backend service by storing id-less messages in a cyclic parent chain. The flaw in `get_message_list` (backend/open_webui/utils/misc.py) caused the chat-history traversal to never terminate, blocking the async event loop and consuming memory until the process died - with the condition persisting across restarts until an operator manually removes the offending messages or upgrades. No public exploit or active exploitation has been identified, but the low barrier (any login) and persistence across restarts make this an operationally impactful issue for self-hosted deployments. | MEDIUM | 6.5 | 0.3% | 53 |
PoC
|
| CVE-2026-59222 | Information disclosure in Open WebUI versions 0.7.0 through 0.9.x allows authenticated channel members to retrieve sensitive administrator settings, including API keys for tool servers and webhook configurations. The /api/v1/channels/{id}/members endpoint fails to sanitize user model responses, exposing full UserModel data to any participant in a shared channel. A public proof-of-concept exists, but active exploitation is not confirmed and the EPSS probability of widespread exploitation is low (0.26%). | MEDIUM | 6.0 | 0.3% | 50 |
PoC
|
| CVE-2026-59216 | Cross-user remote code execution in Open WebUI before 0.10.0 lets an authenticated user run arbitrary code interpreter Python or invoke tools inside another logged-in user's session. The get_event_call handler dispatched execute:python and execute:tool Socket.IO events to any client-supplied session_id that was merely 'connected', so an attacker who harvested a victim's socket ID via the ydoc:document:join collaboration flow could hijack that session. A proof-of-concept is indicated in the SSVC data, though the flaw is not in CISA KEV and EPSS rates near-term mass exploitation low (0.28%, 19th percentile). | CRITICAL | 9.0 | 0.3% | 45 |
PoC
|
| CVE-2026-88001 | SSRF filter-bypass in Open WebUI 0.9.5-0.11.0 allows authenticated users to route server-side fetches to private networks, loopback addresses, and cloud metadata endpoints by exploiting unvalidated HTTP redirect destinations. When AIOHTTP_CLIENT_ALLOW_REDIRECTS is enabled, the platform applies WEB_FETCH_FILTER_LIST and private-address controls only to the initial request URL, not to redirect hops - allowing a crafted redirect chain to reach AWS IMDS, Azure platform channels, or internal services. No public exploit exists and the issue is not in CISA KEV, but the scope-changed CVSS vector (S:C) and potential exposure of cloud IAM credentials in hosted deployments elevate practical risk above the 5.0 base score. | MEDIUM | 5.0 | 0.3% | 45 |
PoC
|
| CVE-2026-0765 | Remote code execution in Open WebUI's install_frontmatter_requirements function allows authenticated attackers to execute arbitrary commands on the host system by bypassing input validation in system call parameters. The vulnerability affects AI/ML deployments using Open WebUI and requires valid authentication credentials to exploit. No patch is currently available. | HIGH | 8.8 | 0.6% | 45 |
No patch
|
| CVE-2026-0766 | Remote code execution in Open WebUI through the load_tool_module_by_id function allows authenticated attackers to execute arbitrary Python code due to insufficient input validation on user-supplied strings. An attacker with valid credentials can leverage this vulnerability to achieve code execution with service account privileges. No patch is currently available, making this a critical risk for deployed Open WebUI instances. | HIGH | 8.8 | 0.6% | 45 |
No patch
|
| CVE-2025-63681 | open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers (a normal user) to stop arbitrary LLM response tasks. | MEDIUM | 4.3 | 0.0% | 42 |
PoC
|
| CVE-2026-59224 | Identity spoofing in Open WebUI before 0.10.0 lets an authenticated low-privileged user impersonate another account by injecting query parameters into the terminal WebSocket URL. Because backend/open_webui/routers/terminals.py built the ws_terminal upstream URL from an unencoded session_id and appended user_id as a query parameter - while the HTTP proxy path trusted an integrity-unbound X-User-Id header - an attacker can make the terminal backend resolve a different user identity, gaining that victim's terminal session context. No public exploit has been identified at time of analysis, but the fix is confirmed in v0.10.0 and the flaw is scored CVSS 8.0. | HIGH | 8.0 | 0.3% | 40 |
|
| CVE-2026-59221 | Path traversal in Open WebUI's terminal proxy (versions 0.9.6 through 0.9.x, fixed in 0.10.0) lets an authenticated attacker reach files and resources outside the intended proxy scope. The _sanitize_proxy_path routine in backend/open_webui/routers/terminals.py decoded incoming proxy paths exactly eight times, so a nine-times percent-encoded ../ sequence survived normalization and was decoded a final time by the upstream terminal server, defeating the traversal check. No public exploit or CISA KEV listing exists at time of analysis, but the scope-changing CVSS 3.1 score of 7.7 (S:C/C:H) signals meaningful confidentiality impact on the backend terminal component. | HIGH | 7.7 | 0.4% | 38 |
|
| CVE-2026-59219 | Session revocation bypass in Open WebUI 0.9.0 through 0.9.x (deployments configured with Redis) lets a holder of a revoked JWT keep authenticating realtime Socket.IO connections. The flaw stems from first-message authentication for Socket.IO connect, user-join, join-channels, join-note, and the terminal websocket calling decode_token without the Redis-backed is_valid_token revocation check, so logout, forced-logout, or token invalidation does not sever active realtime access. No public exploit is identified at time of analysis and it is not listed in CISA KEV; the fix is version 0.10.0. | HIGH | 7.1 | 0.2% | 36 |
PoC
|