open-webui vulnerabilities and threats

Open WebUI versions from 0.8.6 up to but not including 0.11.4 have a privilege escalation vulnerability in the terminal proxy. Authenticated users can exploit this flaw to access the Terminals administrator API using a shared key, allowing them to list or stop other users' terminals and modify terminal policies, including injecting environment variables into other users' terminals. This vulnerability is fixed in version 0.11.4.

Open WebUI versions from 0.9.0 up to but not including 0.11.4 contain a denial of service vulnerability. Authenticated users with automations permission can submit unsatisfiable recurrence rules, such as invalid dates like February 30th, to the automations create or update endpoints. This causes the shared event loop to stall for several seconds per request, effectively blocking the instance. The vulnerability is fixed in version 0.11.4.

CVE-2026-109298 is a high-severity vulnerability in open-webui versions 0.11.0 through before 0.11.4. It involves uncontrolled resource consumption caused by the compilation of user-supplied nested counted repetition regex patterns in the grep engine used for knowledge and chat file searches. Authenticated users can exploit this by submitting crafted patterns that block the event loop and exhaust worker memory, leading to denial of service conditions. The issue is fixed in version 0.11.4.

Open WebUI versions 0.11.0 through 0.11.3 contain a denial of service vulnerability in the automation recurrence-rule validator. The flaw arises because the sub-daily frequency guard parses rule text more strictly than the calendar library that executes it, allowing specially crafted rules that expand per-second to block the shared event loop for minutes per request and on every scheduler poll. This can be exploited by users permitted to create automations to cause service disruption.

Open WebUI versions before 0.11.4 have an authorization bypass vulnerability that allows authenticated users to access disabled model provider backends by specifying a backend index. This can be done via path segments or query parameters on certain API routes, enabling attackers to trigger requests with configured API keys, read version information, and enumerate backend connections.

Open WebUI versions from 0.11.0 up to but not including 0.11.4 contain a regular expression denial of service (ReDoS) vulnerability. Authenticated users can exploit this flaw by providing file search patterns that cause catastrophic backtracking in regex processing, stalling server workers and blocking the event loop for approximately two seconds per repeated call. This vulnerability is fixed in version 0.11.4.

Open WebUI versions from 0.6.42 up to but not including 0.11.4 have a vulnerability where authenticated users can cause uncontrolled resource consumption by sending chat messages containing compressed remote image URLs. This leads to unbounded decompression of gzip-encoded responses, exhausting server memory and causing denial of service for all users. The issue is fixed in version 0.11.4.

Open WebUI versions from 0.11.0 up to but not including 0.11.4 contain an information disclosure vulnerability. Authenticated non-admin users with tool export permission can exploit this flaw to retrieve the full Python source code of read-only shared tools via a GET request to /api/v1/tools/export. This exposure includes embedded API keys and credentials, potentially compromising sensitive information. The vulnerability is fixed in version 0.11.4.

Open WebUI versions from 0.6.27 up to but not including 0.11.4 have an information disclosure vulnerability that exposes user session cookies to destination servers during OAuth-mode connections. This allows operators of OpenAI-compatible connections, OpenAPI tool servers, or terminal servers to capture and replay session cookies, potentially hijacking user accounts including those with administrative privileges. The vulnerability is fixed in version 0.11.4.

Open WebUI versions from 0.6.33 up to but not including 0.11.4 contain a cross-site scripting (XSS) vulnerability. Authenticated users can exploit this flaw by storing malicious javascript: URLs in citation embed_url fields. When a victim clicks on a crafted chat citation, the malicious script executes in their session, potentially allowing attackers to steal localStorage tokens and impersonate the victim. This vulnerability is fixed in version 0.11.4.

Open WebUI versions from 0.11.1 up to but not including 0.11.4 contain a stored cross-site scripting (XSS) vulnerability in the DocxPreview.svelte component. This flaw allows authenticated users to upload specially crafted DOCX files containing malicious HTML or script-scheme hyperlinks. Exploitation can lead to theft of an administrator's session token from local storage and potential takeover of the instance. The vulnerability is fixed in version 0.11.4.

Open WebUI versions from 0.8.8 up to but not including 0.11.4 have an authorization vulnerability where deactivated users can continue executing terminal commands via an already open terminal WebSocket. The vulnerability arises because the terminal proxy route only checks access on the first message, allowing continued command execution and file operations despite user deactivation. This issue is fixed in version 0.11.4.

Open WebUI versions before 0.11.4 contain a stored cross-site scripting (XSS) vulnerability in the MarkdownInlineTokens.svelte component. This flaw allows authenticated users to embed malicious javascript: links in shared chats. When victims click these links, their JSON Web Tokens (JWTs) stored in local storage can be stolen, including those of administrators. The vulnerability is fixed in version 0.11.4.

Open WebUI versions from 0.9.6 up to but not including 0.11.4 have an authorization bypass vulnerability. This flaw allows users with read access to any knowledge base to supply a directory_id belonging to a different knowledge base when requesting the file listing. As a result, the API response exposes folder names, owner user IDs, and knowledge base IDs of the specified directory and its ancestor directories.

Open WebUI versions from 0.7.0 up to but not including 0.11.4 have a cross-origin message handling vulnerability in the SyncStatsModal component. This flaw allows any website to steal a signed-in user's session token by sending unvalidated verify:chat messages. Attackers can exploit a path traversal in the chat ID to redirect authenticated requests to the authentication endpoint, thereby obtaining the victim's JWT token and gaining full API access. The vulnerability is fixed in version 0.11.4.

Open WebUI versions from 0.6.0 up to but not including 0.11.4 have an improper access control vulnerability in the has_access_to_file function. This flaw allows former knowledge base collaborators to retain access to files through stale cached references, enabling them to download or delete files, including those in private knowledge bases. The issue is fixed in version 0.11.4.

Open WebUI versions from 0.11.0 up to but not including 0.11.4 have an improper authorization vulnerability in the chat fork handler. This flaw allows shared folder members who have been downgraded to read-only access to fork chats they originally created while having write access, placing attacker-controlled chats into the folder without verifying write permissions. The vulnerability was fixed in version 0.11.4.

Open WebUI versions from 0.11.1 up to but not including 0.11.4 have an authorization bypass vulnerability in the OAuth token exchange endpoint. The flaw occurs because the system reads role claims only from the userinfo response of the identity provider and retains the user's existing role if no roles claim is found, ignoring roles sent solely in the ID token. This allows users with linked accounts to maintain elevated roles even if their identity provider role no longer satisfies the OAuth role policy by sending a valid provider access token to the token exchange endpoint. The issue is fixed in version 0.11.4.

CVE-2026-70482 is an improper authentication vulnerability in open-webui versions from 0.8.0 up to but not including 0.11.0. When the ENABLE_OAUTH_TOKEN_EXCHANGE setting is enabled, the /oauth/{provider}/token/exchange endpoint accepts a raw provider access token and validates it by calling the provider's userinfo endpoint without verifying the OAuth client to which the token was issued. This allows an attacker holding any access token issued by the same provider for any client to exchange it for an open-webui session as the token user, potentially gaining unauthorized access. The issue is fixed in version 0.11.0.

Open WebUI versions prior to 0.9.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the _process_picture_url() function within the OAuth utility module. This flaw allows an attacker with limited privileges to cause the server to make arbitrary HTTP requests to internal or external resources by exploiting unvalidated URL fetching from OAuth picture claims. The vulnerability is fixed in version 0.9.0.