open-webui vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-70494Highopen-webui: Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder CVE-2026-70493Mediumopen-webui: Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically CVE-2026-70492Highopen-webui: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages CVE-2026-70491Mediumopen-webui: Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints CVE-2026-70490Mediumopen-webui: Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check CVE-2026-70489Mediumopen-webui: Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing CVE-2026-54020Mediumopen-webui: Open WebUI: DNS Rebinding SSRF Bypass CVE-2026-70487Mediumopen-webui: Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata CVE-2026-70488Mediumopen-webui: Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup CVE-2026-70486Highopen-webui: Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin CVE-2026-70485Highopen-webui: Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs CVE-2026-70484Mediumopen-webui: Open WebUI: Users denied the image-generation permission can still generate images via chat completions CVE-2026-70480Mediumopen-webui: Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering CVE-2026-70483Lowopen-webui: Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint CVE-2026-70482Highopen-webui: Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client CVE-2026-70481Mediumopen-webui: Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages CVE-2026-70479Highopen-webui: Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader CVE-2026-59221Highopen-webui: open-webui terminal proxy path traversal guard bypass via 9x encoded traversal CVE-2026-59225Mediumopen-webui: Open WebUI: Arena task endpoints can bypass underlying model access controls CVE-2026-59212Mediumopen-webui: Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete CVE-2026-59224Highopen-webui: Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal…CVE-2026-59223Mediumopen-webui: Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching CVE-2026-59222Mediumopen-webui: Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials CVE-2026-59215Lowopen-webui: Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding CVE-2026-59213Lowopen-webui: Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo