{"kind": "version", "path": "vulns/pypi/open-webui/0.8.12", "name": "open-webui", "product": "open-webui", "ecosystem": "PyPI", "version": "0.8.12", "items": [{"id": "CVE-2026-88006", "noindex": false, "published": "2026-09-10T14:43:17.538Z", "modified": "2026-09-10T17:46:41.061Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00371, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-88006", "title": "Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session at their existing role through this endpoint. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-wvm9-9g5j-623f", "https://github.com/open-webui/open-webui/commit/d799e81edbdc971c6deb096b6474cd95b93504bf", "https://github.com/open-webui/open-webui/releases/tag/v0.11.1"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-88005", "noindex": false, "published": "2026-09-10T14:38:52.367Z", "modified": "2026-09-15T14:35:40.830Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00371, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-88005", "title": "Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.9.0, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through this endpoint. This issue is fixed in version 0.9.0.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-4qg5-cxx4-g927", "https://github.com/open-webui/open-webui/pull/23639", "https://github.com/open-webui/open-webui/commit/fb5ef978bfb451c3f2221931e08e54250cec58ca"], "fixes": ["0.9.0"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-88002", "noindex": false, "published": "2026-09-09T21:40:06.412Z", "modified": "2026-09-14T18:41:05.853Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00583, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-88002", "title": "Open WebUI: Any authenticated user can hang the server via a cyclic chat message history", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/open_webui/utils/misc.py advanced through a chat history by map key but tracked visited entries using each message body's optional id field. An authenticated user could store id-less messages in a parent cycle and trigger a non-terminating walk that blocked the async event loop, grew memory until termination, and remained persistent across process restarts. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-jqhh-cjmq-vmv6", "https://github.com/open-webui/open-webui/pull/28034", "https://github.com/open-webui/open-webui/commit/5c79ccc9e5c9efc2bc024d8f0b9757652ece929a"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-87999", "noindex": false, "published": "2026-09-09T21:33:18.322Z", "modified": "2026-09-10T15:35:54.372Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N", "severity": "high", "epss": 0.0036, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-87999", "title": "Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/open_webui/retrieval/web/utils.py treated Python's globally routable address classification as proof that a destination was external. An authenticated user could make an Azure-hosted instance fetch and return content from 168.63.129.16, the Azure platform channel, as well as other reserved ranges that the standard classification did not reject. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-34r3-9m95-vq73", "https://github.com/open-webui/open-webui/pull/27823", "https://github.com/open-webui/open-webui/commit/e3e4bd87df6fc629e7e22081d980d55a7632b8b7"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-87995", "noindex": false, "published": "2026-09-09T21:26:30.890Z", "modified": "2026-09-10T17:54:56.492Z", "cvss": 8.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "severity": "high", "epss": 0.00417, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-87995", "title": "Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin. Because the terminal proxy serves that content from the Open WebUI origin, an authenticated user with access to a shared terminal server could host script on a previewed port and take over a victim's account when the victim opened the preview. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-jmc6-2wr8-h3wj", "https://github.com/open-webui/open-webui/commit/54d7a223707f03172efbb9e754db6e69709956d0", "https://github.com/open-webui/open-webui/releases/tag/v0.11.1"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-87017", "noindex": false, "published": "2026-09-09T21:23:27.489Z", "modified": "2026-09-10T17:48:13.471Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00372, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-87017", "title": "Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.1, the built-in knowledge search tool passed the caller's readable knowledge identifiers through a metadata filter, but the search methods in eleven shipped vector backends ignored that filter. An authenticated user on an affected backend could enumerate the identifiers, names, and descriptions of inaccessible knowledge bases from the shared collection, although the associated document text remained in separate collections. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-pcvc-8vrv-8q6w", "https://github.com/open-webui/open-webui/commit/1d6d4e6e6647e1d403438ede7bd9ba20bc4cc8f6", "https://github.com/open-webui/open-webui/releases/tag/v0.11.1"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-87016", "noindex": false, "published": "2026-09-09T21:21:43.877Z", "modified": "2026-09-14T13:43:30.787Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00599, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-87016", "title": "Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject containing percent or underscore wildcard characters could resolve to a different stored identity, potentially selecting an administrator account and issuing the attacker that account's session; PostgreSQL deployments were not affected. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7", "https://github.com/open-webui/open-webui/pull/28624", "https://github.com/open-webui/open-webui/commit/73c1f5806aeb6345dad5de8f5aa26d1f3d0bef80"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-87015", "noindex": false, "published": "2026-09-09T21:03:34.145Z", "modified": "2026-09-10T13:50:33.969Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00478, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-87015", "title": "Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached and a session or system OAuth connection was processed last, a request to a different server configured for bearer authentication could include the calling user's Open WebUI session cookies, allowing that server's operator to reuse the session and take over the account. This issue is fixed in version 0.11.1.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-p78m-89r6-pgf7", "https://github.com/open-webui/open-webui/pull/28630", "https://github.com/open-webui/open-webui/commit/cd9db21c5276807a2975ddba17cef369ad1114b7"], "fixes": ["0.11.1"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-70491", "noindex": false, "published": "2026-08-04T20:51:27.840Z", "modified": "2026-08-05T14:45:34.369Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00478, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-70491", "title": "Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/{id} endpoints in backend/open_webui/routers/tools.py returned full Python tool source to authenticated non-admin read-only users. ToolResponse deliberately omitted source and specs, but ToolUserResponse permitted extra fields and handlers spread a full tool model dump into the response, re-admitting omitted fields. A non-admin with a read grant can obtain another user's server-side tool source, which commonly embeds hard-coded API keys, credentials, and internal ", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-3r7g-q6cg-q2vx", "https://github.com/open-webui/open-webui/pull/27005", "https://github.com/open-webui/open-webui/commit/c05de13b4fca1ac8a17153782b46b3d0aacf491c"], "fixes": ["0.11.0"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-70490", "noindex": false, "published": "2026-08-04T20:44:54.737Z", "modified": "2026-08-05T18:07:10.733Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.00283, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-70490", "title": "Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/open_webui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that get_verified_user enforces on HTTP terminal routes. An account whose role is pending, including a registered but unapproved account or an account deactivated back to pending, can open an interactive terminal session when at least one terminal server is configured and its access grants cover the account. This loses the account-approval boundary for terminal access while the ", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-5gpj-vj23-vhhv", "https://nvd.nist.gov/vuln/detail/CVE-2026-70490"], "fixes": ["0.11.0"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-54020", "noindex": false, "published": "2026-08-04T20:38:27.215Z", "modified": "2026-08-05T13:55:01.253Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "severity": "medium", "epss": 0.00252, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-54020", "title": "Open WebUI: DNS Rebinding SSRF Bypass", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL validation and rejected private, loopback, and link-local addresses, but the HTTP clients resolved the hostname again at connection time. An authenticated attacker who controlled authoritative DNS for a submitted hostname could answer with a public address during validation and an internal one during connection, reaching cloud metadata, loopback admin APIs, or internal services through URL ingest, chat image_url fetches, image editing, or OAuth profile-picture fetches, with most paths returning the r", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-h6x2-583h-x99r", "https://github.com/open-webui/open-webui/releases/tag/v0.11.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-54020"], "fixes": ["0.11.0"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-70487", "noindex": false, "published": "2026-08-04T20:16:11.523Z", "modified": "2026-08-05T14:46:10.771Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00416, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-70487", "title": "Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-supplied knowledge attachments without filtering them against the caller's read access. Any authenticated user who knew another user's file id could have the builtin knowledge tools return indexed chunks from that file, causing a read-only cross-user confidentiality loss while leaving knowledge-base permissions and saved workspace model validation unaffected. This issue is fixed in 0.11.0.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-6xhv-rxhv-pwm4", "https://github.com/open-webui/open-webui/commit/305880f2e2aeb2dda2f4b2a18a20bdcd558f7134", "https://github.com/open-webui/open-webui/releases/tag/v0.11.0"], "fixes": ["0.11.0"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-70484", "noindex": false, "published": "2026-08-04T19:56:54.210Z", "modified": "2026-08-05T14:48:18.140Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00413, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-70484", "title": "Open WebUI: Users denied the image-generation permission can still generate images via chat completions", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legacy chat-completions features block trusted a client-supplied image_generation flag and did not re-check the features.image_generation permission that the direct image routes and native function-calling path enforce. An authenticated user whose image-generation permission had been revoked could still consume the operator's configured image provider through chat completions, spending API credits and provider quota and writing generated files to operator storage, without exposing provider credentials or other users' data. This i", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-g423-grf7-98rv", "https://github.com/open-webui/open-webui/pull/26703", "https://github.com/open-webui/open-webui/commit/897d69a35c65f8ab54583bb9ca8dc74eab7bcd29"], "fixes": ["0.11.0"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-70482", "noindex": false, "published": "2026-08-04T19:51:58.168Z", "modified": "2026-08-06T03:55:22.402Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00569, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-70482", "title": "Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.0, when ENABLE_OAUTH_TOKEN_EXCHANGE=True, /oauth/{provider}/token/exchange accepts a raw provider access token and validates it by calling the provider userinfo endpoint without confirming which OAuth client the token was issued to. Anyone holding an access token minted for any client registered with the same provider could exchange it for an Open WebUI session as that token user, including applications the operator does not control and has never authorized. This issue is fixed in 0.11.0.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-rq84-p6rr-vf89", "https://github.com/open-webui/open-webui/commit/b190dcf3caa00dc8b7b9c7312828298d9143f60d", "https://github.com/open-webui/open-webui/commit/c4332be71e6e9c314e8a13b9d2819a6932561630"], "fixes": ["0.11.0"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-70481", "noindex": false, "published": "2026-08-04T19:45:37.332Z", "modified": "2026-08-05T14:29:13.653Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "severity": "medium", "epss": 0.00427, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-70481", "title": "Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete handlers accepted any caller holding write access on the channel without checking that the caller wrote the message. Because write access is the same grant a member needs to post, any ordinary participant in a shared standard channel could rewrite or permanently delete another participant message, while group and direct message handlers enforced authorship. This issue is fixed in 0.11.0.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-mj5r-jf49-m3w7", "https://github.com/open-webui/open-webui/pull/27197", "https://github.com/open-webui/open-webui/commit/c609ec41154fa092fa0af80d9d365de06b666286"], "fixes": ["0.11.0"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-70480", "noindex": false, "published": "2026-08-04T19:43:15.645Z", "modified": "2026-08-05T14:18:27.453Z", "cvss": 4.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N", "severity": "medium", "epss": 0.00346, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-70480", "title": "Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.34 until 0.11.0, Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer browser without a restricted resource loader. Any user who can place such a block where another user will see it can make that user browser issue attacker-chosen outbound GET requests and read responses from same-origin or CORS-permissive targets into the rendered page. This issue is fixed in 0.11.0.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-rffm-9q57-q649", "https://github.com/open-webui/open-webui/pull/26806", "https://github.com/open-webui/open-webui/commit/5278eb906ebecefc6538a19bc86df09d997e43e6"], "fixes": ["0.11.0"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-56398", "noindex": false, "published": "2026-07-15T11:25:30.722Z", "modified": "2026-07-15T13:25:55.678Z", "cvss": 8.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00635, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-56398", "title": "Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI", "description": "Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs. Authenticated users who visit the profile image endpoint receive attacker-controlled SVG content with inline disposition and no default security headers, enabling script execution in the same origin to steal authentication tokens and achieve account takeover.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-3wgj-c2hg-vm6q", "https://www.vulncheck.com/advisories/open-webui-stored-cross-site-scripting-via-oauth-picture-claim-svg-data-uri", "https://nvd.nist.gov/vuln/detail/CVE-2026-56398"], "fixes": ["0.9.5"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-59225", "noindex": false, "published": "2026-07-09T17:12:14.141Z", "modified": "2026-07-09T18:08:12.064Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L", "severity": "medium", "epss": 0.00367, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-59225", "title": "Open WebUI: Arena task endpoints can bypass underlying model access controls", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.12 before 0.10.0, an authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected underlying model. The task routes call utils.chat.generate_chat_completion() directly. In that direct path, arena fallback resolution happens after the wrapper access check and then recurses with bypass_filter=True, skipping the selected submodel's", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-m3qf-58wf-w979", "https://github.com/open-webui/open-webui/pull/26046", "https://github.com/open-webui/open-webui/commit/dc4924b66e655b315e3be4430a3e51b7d5c20acc"], "fixes": ["0.10.0"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-59224", "noindex": false, "published": "2026-07-09T17:09:31.980Z", "modified": "2026-07-10T03:55:48.312Z", "cvss": 8.0, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.00391, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-59224", "title": "Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/open_webui/routers/terminals.py built the ws_terminal upstream URL from an unencoded session_id and appended user_id as a query parameter, allowing query injection to make the terminal backend resolve another user identity; the HTTP proxy path also forwarded X-User-Id as an integrity-unbound identity claim. This issue is fixed in version 0.10.0.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-j657-m4c4-24jq", "https://github.com/open-webui/open-webui/pull/26042", "https://github.com/open-webui/open-webui/commit/5f3a628a8d291bb5d33e1a0b0c89fb62a2927934"], "fixes": ["0.10.0"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-59223", "noindex": false, "published": "2026-07-09T17:00:08.976Z", "modified": "2026-07-09T17:53:06.003Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00383, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-59223", "title": "Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching", "description": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, WEB_FETCH_FILTER_LIST matching compared configured host entries against URL strings and non-label-boundary suffixes, allowing path-based blocklist bypasses such as !internal.example.com in a URL path and sibling-domain matches that did not reflect the intended hostname policy. This issue is fixed in version 0.10.0.", "references": ["https://github.com/open-webui/open-webui/security/advisories/GHSA-qg3f-8x3j-ggf2", "https://github.com/open-webui/open-webui/pull/25949", "https://github.com/open-webui/open-webui/commit/087878ce848a4d828012068b5997dac480f43656"], "fixes": ["0.10.0"], "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}]}], "total": 83, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 5, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "open-webui", "path": "vulns/pypi/open-webui", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["0.11.0", "0.10.2", "0.10.1", "0.10.0", "0.9.6", "0.9.5", "0.9.4", "0.9.3", "0.9.2", "0.9.1", "0.9.0", "0.8.12"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-15T14:35:40.830Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}