open-webui vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-109572 Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals aHigh 7.2 · Oct 12, 2026
• CVE-2026-109299 Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instanceHigh 7.1 · Oct 12, 2026
• CVE-2026-109298 Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted High 7.1 · Oct 12, 2026
• CVE-2026-109297 Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rHigh 7.1 · Oct 12, 2026
• CVE-2026-109294 Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supHigh 7.1 · Oct 12, 2026
• CVE-2026-109293 Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to oHigh 7.1 · Oct 12, 2026
• CVE-2026-109292 Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receivinHigh 7.6 · Oct 12, 2026
• CVE-2026-109291 Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by stoHigh 8.5 · Oct 12, 2026
• CVE-2026-109290 Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute scripHigh 8.4 · Oct 12, 2026
• CVE-2026-109288 Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefsHigh 7.2 · Oct 12, 2026
• CVE-2026-109286 Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user'sHigh 8.6 · Oct 12, 2026
• CVE-2026-87999 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.High 7.1 · Sep 9, 2026
• CVE-2026-87998 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.High 7.1 · Sep 9, 2026
• CVE-2026-87996 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.High 7.7 · Sep 9, 2026
• CVE-2026-87995 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.High 8.7 · Sep 9, 2026
• CVE-2026-87016 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.High 8.1 · Sep 9, 2026
• CVE-2026-87011 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.High 7.5 · Sep 9, 2026
• CVE-2026-59714 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.High 7.1 · Aug 13, 2026
• CVE-2026-70494 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.High 8.1 · Aug 4, 2026
• CVE-2026-70492 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.High 8.7 · Aug 4, 2026
• CVE-2026-70486 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.High 8.2 · Aug 4, 2026
• CVE-2026-70485 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.High 7.1 · Aug 4, 2026
• CVE-2026-70482 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.High 8.1 · Aug 4, 2026
• CVE-2026-70479 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.High 7.7 · Aug 4, 2026
• CVE-2026-56400 open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests toCritical 9 · Jul 15, 2026