p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Schwachstellen im Stack Python · Seite 62

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für Python: 360. Davon im KEV-Katalog: 1.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Python

Sicherheitslücken: 7131

  1. CVE-2026-59213

    Niedrig · CVSS 3.5EPSS 0,37%Korrektur verfügbar

    Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

    Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 before 0.10.0, get_all_models handlers in routers/openai.py and routers/ollama.py passed a lambda to aiocache key instead of key_builder, causing permission-filtered per-user model lists to share a static cache entry and exposing one user’s model list to another caller during the TTL window. This issue is fixed in version 0.10.0.

    open-webui open-webuiPython
    • Auf 0.10.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-59217

    Mittel · CVSS 4.3EPSS 0,37%Korrektur verfügbar

    Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

    Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the file upload path accepted metadata.knowledge_id and auto-linked uploaded files to a target knowledge base without applying the write-access check used by /api/v1/knowledge//file/add, allowing read-only knowledge-base users to add arbitrary files. This issue is fixed in version 0.10.0.

    open-webui open-webuiPython
    • Auf 0.10.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-59216

    Hoch · CVSS 7.7EPSS 0,45%Korrektur verfügbar

    Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

    Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call delivered execute:python and execute:tool Socket.IO events to a client-supplied session_id after checking only that the session was connected, allowing authenticated users who learned another socket ID through ydoc:document:join to run code interpreter Python or tools in that user session. This issue is fixed in version 0.10.0.

    open-webui open-webuiPython
    • Auf 0.10.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-59219

    Hoch · CVSS 7.1EPSS 0,55%Korrektur verfügbar

    Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

    Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0 with Redis configured, Socket.IO connect, user-join, join-channels, join-note, and the terminal websocket first-message authentication used decode_token without the Redis-backed is_valid_token revocation check, allowing revoked JWTs to continue authenticating realtime connections. This issue is fixed in version 0.10.0.

    open-webui open-webuiPython
    • Auf 0.10.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2026-59715

    Niedrig · CVSS 3.1EPSS 0,36%Korrektur verfügbar

    Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

    Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.16 before 0.10.0, the Socket.IO server is configured with always_connect=True. The ydoc:awareness:update and ydoc:document:leave Socket.IO handlers accepted collaborative-document events without requiring an authenticated user, allowing unauthorized manipulation of document collaboration state. This issue is fixed in version 0.10.0.

    open-webui open-webuiPython
    • Auf 0.10.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2026-59220

    Mittel · CVSS 6.5EPSS 0,57%Korrektur verfügbar

    Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

    Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.2 before 0.10.0, the SKILL_MENTION_RE and strip_re regular expressions in backend/open_webui/utils/middleware.py parsed <$skillId|label> skill mentions with overlapping quantifiers, allowing an authenticated chat message containing <$ without a closing > to trigger quadratic backtracking and block the asyncio event loop. This issue is fixed in version 0.10.0.

    open-webui open-webuiPython
    • Auf 0.10.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2026-59226

    Niedrig · CVSS 3.1EPSS 0,53%Korrektur verfügbar

    Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

    Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0, execute_automation rehydrated automation owners without rechecking that they were still active or still had features.automations, and check_model_access only enforced private-model grants for the exact user role, allowing deactivated pending users to continue scheduled model execution. This issue is fixed in version 0.10.0.

    open-webui open-webuiPython
    • Auf 0.10.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2026-59227

    Mittel · CVSS 4.3EPSS 0,42%Korrektur verfügbar

    Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission

    Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 before 0.10.0, POST /api/v1/images/edit required only a verified account and did not enforce the global image-edit switch or the per-user image-generation permission, allowing a non-admin user to invoke server-side image editing with administrator-configured provider credentials. This issue is fixed in version 0.10.0.

    open-webui open-webuiPython
    • Auf 0.10.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2026-59218

    Mittel · CVSS 5.3EPSS 0,41%Korrektur verfügbar

    Open WebUI: Account enumeration via observable login timing discrepancy

    Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the /api/v1/auths/signin endpoint looked users up by email and only ran bcrypt password verification when a credential existed, making registered-account attempts measurably slower than missing-email attempts and allowing unauthenticated account enumeration. This issue is fixed in version 0.10.0.

    open-webui open-webuiPython
    • Auf 0.10.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2026-59214

    Hoch · CVSS 7.3EPSS 0,42%Korrektur verfügbar

    Open WebUI: Stored web worker XSS via Pyodide

    Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs client-side Python with Pyodide in a same-origin web worker, allowing stored chat payloads that use pyodide.http.pyfetch or the js module fetch and XMLHttpRequest APIs to issue authenticated same-origin requests when a victim clicks Run, which can reach admin-only endpoints and execute server-side code through configured tools. This issue is fixed in version 0.10.0.

    open-webui open-webuiPython
    • Auf 0.10.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  11. GHSA-52vm-mxx8-f227

    Hoch · CVSS 7.7Korrektur verfügbar

    Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths

    ### Impact In Phantom <= 1.3.0, when `PHANTOM_OUTPUT_DIR` was unset (the default), the MCP tools accepted arbitrary absolute output paths with no confinement. Anything able to send tool calls (e.g. an AI agent driving the MCP interface) could **write or overwrite arbitrary files** the process user can write — including shell startup files (`~/.zshrc`) or a Reaper `__startup.lua`, which is effectively local code execution on a developer workstation. Separately, the stem-separation and render paths decoded input audio with no size/duration cap (the analysis path was already guarded). A small, highly compressed FLAC/OGG could expand to multi-g

    phantom-audioPython
    • Auf 1.3.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2026-54499

    Hoch · CVSS 7.5EPSS 0,52%Korrektur verfügbar

    Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders

    Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loaders such as stanza.models.common.pretrain.Pretrain.load() attempt torch.load(..., weights_only=True) but fall back to torch.load(..., weights_only=False) on attacker-controllable pickle.UnpicklingError, allowing a malicious .pt pretrain or model file to execute arbitrary pickle code when a Stanza NLP pipeline loads it. This issue is fixed in version 1.12.2.

    stanza stanzaPython
    • Auf 1.12.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2026-55830

    Hoch · CVSS 8.3EPSS 0,29%Korrektur verfügbar

    RestrictedPython guard hooks can be shadowed via positional-only arguments

    RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Prior to 8.3, check_function_argument_names() rejected protected guard hook names for regular, variadic, and keyword-only arguments but omitted positional-only arguments, allowing __getattr__, _getitem_, _write_, or _print_ to be shadowed by a local parameter and bypass the embedding application's access policy. This issue is fixed in version 8.3.

    restrictedpython restrictedpython restrictedpython restrictedpython restrictedpython restrictedpython restrictedpython restrictedpython restrictedpython restrictedpython restrictedpythonBetriebssysteme Python
    • Auf 8.3 aktualisieren
    • Auf 8.4-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. CVE-2026-35211

    Mittel · CVSS 6.5EPSS 0,52%Korrektur verfügbar

    OpenCTI: Elasticsearch Painless Script Injection via GraphQL `script` filter operator allows authenticated user to exfiltrate data and cause DoS

    OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows any authenticated user with the KNOWLEDGE capability to pass user-supplied Elasticsearch Painless script values directly into search queries without validation or sanitization, allowing computationally expensive scripts to consume cluster CPU resources and degrade or deny service for all users. This issue is fixed in version 7.260401.0.

    opencti pyctiPython
    • Auf 7.260401.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2026-35210

    Hoch · CVSS 7.1EPSS 0,35%Korrektur verfügbar

    OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header Injection

    OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGE_KNUPDATE permission to bypass Confidence Level validation and Object Marking restrictions by injecting the synchronized-upsert: true HTTP header, enabling attackers to downgrade confidence levels, remove security markings such as TLP:RED, manipulate relationships, and affect STIX object types including Indicators, ThreatActors, Malware, and Reports. This issue is fixed in version 7.260326.0.

    opencti pyctiPython
    • Auf 7.260326.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  16. CVE-2026-54528

    Hoch · CVSS 7.1EPSS 0,41%Korrektur verfügbar

    jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

    JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase() in GitHandler.prepare() in jupyterlab_git/handlers.py to enforce excluded_paths, allowing an authenticated user on a case-insensitive filesystem to vary URL path casing and read excluded directories. This issue is fixed in version 0.54.0.

    jupyterlab-git jupyterlab-gitPython
    • Auf 0.54.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. CVE-2026-54527

    Kritisch · CVSS 9.3EPSS 0,53%Korrektur verfügbar

    JupyterLab Git: Stored XSS leading to RCE

    JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This issue is fixed in version 0.54.0.

    jupyterlab-git jupyterlab-git jupyterlab-git-core @jupyterlab/gitPython Node.js
    • Auf 0.54.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. CVE-2026-54590

    Mittel · CVSS 5.9EPSS 0,34%Korrektur verfügbar

    AsyncSSH AuthorizedKeysFile username substitution bypass through ~ and environment expansion

    AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309 in SSHServerConfig._set_tokens that blocks /, , and .. before %u substitution in AuthorizedKeysFile but does not block a leading ~ or ${ENV}, allowing later expansion in _expand_val and Path(filename).expanduser() to escape the intended authorized-keys directory. This issue is fixed in version 2.23.1.

    asyncssh python-asyncssh asyncssh python-asyncssh python-asyncssh python-asyncssh python-asyncssh python-asyncssh python-asyncssh python-asyncssh python-asyncsshBetriebssysteme Python
    • Auf 2.23.1 aktualisieren
    • Auf 2.24.0-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2026-54591

    Hoch · CVSS 8.1EPSS 0,49%Korrektur verfügbar

    AsyncSSH: SCP Path Traversal to Arbitrary File Write

    AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.1, a malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../ traversal sequences because _parse_cd_args in scp.py returns server-provided names verbatim and _recv_files joins them to the destination path without enforcing the target directory boundary. This issue is fixed in version 2.23.1.

    asyncssh python-asyncssh python-asyncssh python-asyncssh asyncssh python-asyncssh python-asyncssh python-asyncssh python-asyncssh python-asyncssh python-asyncssh python-asyncsshBetriebssysteme Python
    • Auf 2.23.1 aktualisieren
    • Auf 2.24.0-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. CVE-2026-55206

    Hoch · CVSS 8.7EPSS 0,27%Korrektur verfügbar

    py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()

    py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, PackInfo._read() in archiveinfo.py used an O(n^2) cumulative sum pattern for attacker-controlled numstreams values parsed from archive headers, allowing a crafted .7z archive to cause excessive CPU consumption during SevenZipFile.init() before extraction. This issue is fixed in version 1.1.3.

    py7zr py7zr py7zr py7zr py7zr py7zr py7zr py7zr py7zr py7zrBetriebssysteme Python
    • Auf 1.1.3 aktualisieren
    • Auf 1.1.3+dfsg-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →