Affected version lines
Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2026-109572 | Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy | ≥ 0.8.6 < 0.11.4 | 7.2 | — | 2026-10-13 | |
| CVE-2026-109300 | Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds | ≥ 0.6.31 < 0.11.4 | 5.1 | — | 2026-10-13 | |
| CVE-2026-109299 | Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation | ≥ 0.9.0 < 0.11.4 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109298 | Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex | ≥ 0.11.0 < 0.11.4 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109297 | Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules | ≥ 0.11.0 < 0.11.4 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109296 | Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes | < 0.11.4 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109295 | Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop | ≥ 0.11.0 < 0.11.4 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109294 | Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image | ≥ 0.6.42 < 0.11.4 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109293 | Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint | ≥ 0.11.0 < 0.11.4 | 7.1 | — | 2026-10-13 | |
| CVE-2026-109292 | Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections | ≥ 0.6.27 < 0.11.4 | 7.6 | — | 2026-10-13 | |
| CVE-2026-109291 | Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url | ≥ 0.6.33 < 0.11.4 | 8.5 | — | 2026-10-13 | |
| CVE-2026-109290 | Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview | ≥ 0.11.1 < 0.11.4 | 8.4 | — | 2026-10-13 | |
| CVE-2026-109289 | Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket | ≥ 0.8.8 < 0.11.4 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109288 | Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links | < 0.11.4 | 7.2 | — | 2026-10-13 | |
| CVE-2026-109287 | Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID | ≥ 0.9.6 < 0.11.4 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109286 | Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal | ≥ 0.7.0 < 0.11.4 | 8.6 | — | 2026-10-13 | |
| CVE-2026-109285 | Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata | ≥ 0.6.0 < 0.11.4 | 2.3 | — | 2026-10-13 | |
| CVE-2026-109283 | Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange | ≥ 0.11.1 < 0.11.4 | 5.3 | — | 2026-10-13 | |
| CVE-2026-109284 | Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint | ≥ 0.11.0 < 0.11.4 | 5.3 | — | 2026-10-13 | |
| CVE-2026-88005 | Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange | * ≥ 0.8.0 < 0.9.0 | 6.5 | — | 2026-09-10 | |
| CVE-2026-88006 | Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange | * ≥ 0.8.0 < 0.11.1 | 6.5 | — | 2026-09-10 | |
| CVE-2026-88002 | Open WebUI: Any authenticated user can hang the server via a cyclic chat message history | * ≥ 0.5.0 < 0.11.1 | 6.5 | — | 2026-09-09 | |
| CVE-2026-88001 | Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets | * ≥ 0.9.5 < 0.11.1 | 5.0 | — | 2026-09-09 | |
| CVE-2026-88000 | Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree | * ≥ 0.10.0 < 0.11.1 | 6.5 | — | 2026-09-09 | |
| CVE-2026-87998 | Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion | * ≥ 0.10.0 < 0.11.1 | 7.1 | — | 2026-09-09 | |
| CVE-2026-87997 | Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions | * ≥ 0.10.0 < 0.11.1 | 4.3 | — | 2026-09-09 | |
| CVE-2026-87999 | Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch | * < 0.11.1 | 7.1 | — | 2026-09-09 | |
| CVE-2026-87017 | Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backen... | * ≥ 0.7.0 < 0.11.1 | 4.3 | — | 2026-09-09 | |
| CVE-2026-87995 | Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin | * ≥ 0.8.11 < 0.11.1 | 8.7 | — | 2026-09-09 | |
| CVE-2026-87996 | Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader | * ≥ 0.9.6 < 0.11.1 | 7.7 | — | 2026-09-09 | |
| CVE-2026-87994 | Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint | * ≥ 0.9.5 < 0.11.1 | 4.3 | — | 2026-09-09 | |
| CVE-2026-87016 | Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite | * ≥ 0.6.41 < 0.11.1 | 8.1 | — | 2026-09-09 | |
| CVE-2026-87012 | Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value | * ≥ 0.9.0 < 0.11.1 | 4.3 | — | 2026-09-09 | |
| CVE-2026-87014 | Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes | * ≥ 0.9.0 < 0.11.1 | 6.5 | — | 2026-09-09 | |
| CVE-2026-87015 | Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication | * ≥ 0.6.27 < 0.11.1 | 6.8 | — | 2026-09-09 | |
| CVE-2026-87013 | Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle | * ≥ 0.10.0 < 0.11.1 | 4.3 | — | 2026-09-09 | |
| CVE-2026-87011 | Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout | * ≥ 0.9.0 < 0.11.1 | 7.5 | — | 2026-09-09 | |
| CVE-2026-59714 | Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids) | * ≥ 0.9.5 < 0.10.0 | 7.1 | — | 2026-08-14 | |
| CVE-2026-70494 | Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolde... | * ≥ 0.10.0 < 0.11.0 | 8.1 | — | 2026-08-04 | |
| CVE-2026-70492 | Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages | * ≥ 0.10.0 < 0.11.0 | 5.4 | — | 2026-08-04 | |
| CVE-2026-70493 | Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrop... | * ≥ 0.9.6 < 0.11.0 | 6.5 | — | 2026-08-04 | |
| CVE-2026-70491 | Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints | * < 0.11.0 | 6.5 | — | 2026-08-04 | |
| CVE-2026-70489 | Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing | * ≥ 0.9.0 < 0.11.0 | 6.5 | — | 2026-08-04 | |
| CVE-2026-70487 | Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata | * ≥ 0.8.8 < 0.11.0 | 6.5 | — | 2026-08-04 | |
| CVE-2026-70488 | Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup | * ≥ 0.9.6 < 0.11.0 | 4.3 | — | 2026-08-04 | |
| CVE-2026-70490 | Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check | * ≥ 0.8.8 < 0.11.0 | 6.3 | — | 2026-08-04 | |
| CVE-2026-54020 | Open WebUI: DNS Rebinding SSRF Bypass | * < 0.11.0 | 6.3 | — | 2026-08-04 | |
| CVE-2026-70486 | Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin | * ≥ 0.9.0 < 0.11.0 | 5.4 | — | 2026-08-04 | |
| CVE-2026-70484 | Open WebUI: Users denied the image-generation permission can still generate images via chat completions | * ≥ 0.7.0 < 0.11.0 | 5.4 | — | 2026-08-04 | |
| CVE-2026-70482 | Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client | * ≥ 0.8.0 < 0.11.0 | 8.8 | — | 2026-08-04 | |
| CVE-2026-70485 | Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs | * ≥ 0.9.0 < 0.11.0 | 7.1 | — | 2026-08-04 | |
| CVE-2026-70483 | Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint | * ≥ 0.9.6 < 0.11.0 | 4.3 | — | 2026-08-04 | |
| CVE-2026-70481 | Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages | * ≥ 0.5.0 < 0.11.0 | 5.4 | — | 2026-08-04 | |
| CVE-2026-70479 | Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader | * ≥ 0.9.6 < 0.11.0 | 7.7 | — | 2026-08-04 | |
| CVE-2026-70480 | Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering | * ≥ 0.6.34 < 0.11.0 | 4.1 | — | 2026-08-04 | |
| CVE-2026-56400 | open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation | < 0.3.14 < 0.3.33 | 9.0 | — | 2026-07-15 | |
| CVE-2026-56398 | Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI | < 0.9.5 | 8.5 | — | 2026-07-15 | |
| CVE-2026-59221 | open-webui terminal proxy path traversal guard bypass via 9x encoded traversal | * ≥ 0.9.6 < 0.10.0 = 0.9.6 | 7.7 | — | 2026-07-09 | |
| CVE-2026-59227 | Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation p... | * ≥ 0.8.11 < 0.10.0 | 5.4 | — | 2026-07-09 | |
| CVE-2026-59226 | Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation | * ≥ 0.9.0 < 0.10.0 | 4.3 | — | 2026-07-09 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).