Start for Free
pypi

open-webui

View on pypi registry
100 Total advisories
100 Vulnerabilities
0 Malware

Dependency scanning

Check whether open-webui is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

Explore dependency scanning Explore AI SAST →

Vulnerabilities

MEDIUM 6.5
PyPI

CVE-2026-45339

Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints
MEDIUM 6.1
PyPI

CVE-2024-6706

Open WebUI Stored Cross-Site Scripting Vulnerability
HIGH 7.5
PyPI

GHSA-w466-2wfc-8g58

Open WebUI has vulnerable dependency on starlette via fastapi
MEDIUM 6.5
PyPI

CVE-2024-7041

open-webui Insecure Direct Object Reference (IDOR) vulnerability
MEDIUM 4.3
PyPI

CVE-2026-87997

Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions
MEDIUM 6.5
PyPI

CVE-2026-88005

Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange
HIGH 7.1
PyPI

CVE-2026-87999

Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
HIGH 7.7
PyPI

CVE-2026-87996

Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
HIGH 7.1
PyPI

CVE-2026-87998

Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
MEDIUM 4.3
PyPI

CVE-2026-87994

Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
MEDIUM 6.8
PyPI

CVE-2026-87015

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication
HIGH 8.7
PyPI

CVE-2026-87995

Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
MEDIUM 6.5
PyPI

CVE-2026-88006

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange
MEDIUM 6.5
PyPI

CVE-2026-87014

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
MEDIUM 4.3
PyPI

CVE-2026-87013

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
HIGH 8.1
PyPI

CVE-2026-87016

Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
MEDIUM 4.3
PyPI

CVE-2026-87012

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
HIGH 7.5
PyPI

CVE-2026-87011

Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
MEDIUM 4.3
PyPI

CVE-2026-87017

Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
MEDIUM 6.5
PyPI

CVE-2026-87014

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
MEDIUM 6.8
PyPI

CVE-2026-87015

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication
HIGH 8.7
PyPI

CVE-2026-87995

Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
MEDIUM 4.3
PyPI

CVE-2026-87017

Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
MEDIUM 6.5
PyPI

CVE-2026-88006

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange
MEDIUM 4.3
PyPI

CVE-2026-87012

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
HIGH 8.1
PyPI

CVE-2026-87016

Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
MEDIUM 4.3
PyPI

CVE-2026-87994

Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
MEDIUM 4.3
PyPI

CVE-2026-87997

Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions
HIGH 7.1
PyPI

CVE-2026-87998

Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
HIGH 7.7
PyPI

CVE-2026-87996

Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
HIGH 7.1
PyPI

CVE-2026-87999

Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
MEDIUM 4.3
PyPI

CVE-2026-87013

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
MEDIUM 6.5
PyPI

CVE-2026-88005

Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange
HIGH 7.5
PyPI

CVE-2026-87011

Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
MEDIUM 6.5
PyPI

CVE-2026-88002

Open WebUI: Any authenticated user can hang the server via a cyclic chat message history
MEDIUM 6.5
PyPI

CVE-2026-88000

Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree
MEDIUM 5.0
PyPI

CVE-2026-88001

Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets
MEDIUM 6.5
PyPI

CVE-2026-88000

Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree
MEDIUM 6.5
PyPI

CVE-2026-88002

Open WebUI: Any authenticated user can hang the server via a cyclic chat message history
MEDIUM 5.0
PyPI

CVE-2026-88001

Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets
MEDIUM 6.5
PyPI

CVE-2024-7037

open-webui allows writing and deleting arbitrary files
MEDIUM 5.3
PyPI

CVE-2026-0767

Withdrawn Advisory: Open WebUI/ZDI-CAN-28259
MEDIUM 6.5
PyPI

CVE-2024-7034

Withdrawn Advisory: Open WebUI Allows Arbitrary File Write via the `/models/upload` Endpoint
HIGH 7.7
PyPI

CVE-2024-7959

Withdrawn Advisory: Open WebUI has SSRF in /openai/models
HIGH 8.3
PyPI

CVE-2024-7039

Withdrawn Advisory: Open WebUI Allows Admin Deletion via API Endpoint
MEDIUM 4.9
PyPI

CVE-2024-7040

Withdrawn Advisory: Open WebUI Access Control
LOW 3.7
PyPI

CVE-2025-15603

Withdrawn Advisory: Open WebUI JWT Key Handler
LOW 2.7
PyPI

CVE-2024-7038

Withdrawn Advisory: open-webui allows enumeration of file names and traversal of directories by observing the error messages
MEDIUM 6.5
PyPI

CVE-2024-7033

Withdrawn Advisory: Open WebUI Allows Arbitrary File Write via the `download_model` Endpoint
HIGH 8.2
PyPI

CVE-2026-70486

Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
MEDIUM 6.5
PyPI

CVE-2026-70489

Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
HIGH 7.7
PyPI

CVE-2026-70479

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
HIGH 7.1
PyPI

CVE-2026-70485

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
HIGH 8.1
PyPI

CVE-2026-70482

Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
MEDIUM 6.3
PyPI

CVE-2026-70490

Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
MEDIUM 5.4
PyPI

CVE-2026-70481

Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages
LOW 3.1
PyPI

CVE-2026-70483

Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint
HIGH 8.7
PyPI

CVE-2026-70492

Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
MEDIUM 5.3
PyPI

CVE-2026-70487

Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata
MEDIUM 6.5
PyPI

CVE-2026-70493

Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically
MEDIUM 4.1
PyPI

CVE-2026-70480

Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering
MEDIUM 6.3
PyPI

CVE-2026-54020

Open WebUI: DNS Rebinding SSRF Bypass
MEDIUM 4.3
PyPI

CVE-2026-70488

Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup
HIGH 8.1
PyPI

CVE-2026-70494

Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder
MEDIUM 6.5
PyPI

CVE-2026-70491

Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints
MEDIUM 4.3
PyPI

CVE-2026-70484

Open WebUI: Users denied the image-generation permission can still generate images via chat completions
HIGH 8.2
PyPI

CVE-2026-70486

Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
LOW 3.1
PyPI

CVE-2026-70483

Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint
MEDIUM 6.5
PyPI

CVE-2026-70491

Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints
MEDIUM 6.5
PyPI

CVE-2026-70493

Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically
HIGH 8.1
PyPI

CVE-2026-70494

Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder
HIGH 7.7
PyPI

CVE-2026-70479

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
MEDIUM 4.1
PyPI

CVE-2026-70480

Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering
HIGH 8.1
PyPI

CVE-2026-70482

Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
HIGH 8.7
PyPI

CVE-2026-70492

Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
MEDIUM 5.4
PyPI

CVE-2026-70481

Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages
MEDIUM 4.3
PyPI

CVE-2026-70488

Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup
HIGH 7.1
PyPI

CVE-2026-70485

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
MEDIUM 6.3
PyPI

CVE-2026-54020

Open WebUI: DNS Rebinding SSRF Bypass
MEDIUM 4.3
PyPI

CVE-2026-70484

Open WebUI: Users denied the image-generation permission can still generate images via chat completions
MEDIUM 6.5
PyPI

CVE-2026-70489

Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
MEDIUM 5.3
PyPI

CVE-2026-70487

Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata
MEDIUM 6.3
PyPI

CVE-2026-70490

Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
MEDIUM 5.4
PyPI

CVE-2026-59212

Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete
MEDIUM 6.5
PyPI

CVE-2026-59220

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config
UNKNOWN
PyPI

CVE-2026-59222

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials
MEDIUM 5.3
PyPI

CVE-2026-59218

Open WebUI: Account enumeration via observable login timing discrepancy
LOW 3.1
PyPI

CVE-2026-59215

Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding
MEDIUM 4.3
PyPI

CVE-2026-59217

Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)
HIGH 7.7
PyPI

CVE-2026-59216

Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id
LOW 3.1
PyPI

CVE-2026-59715

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)
MEDIUM 4.3
PyPI

CVE-2026-59223

Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching
LOW 3.5
PyPI

CVE-2026-59213

Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)
MEDIUM 5.4
PyPI

CVE-2026-59225

Open WebUI: Arena task endpoints can bypass underlying model access controls
HIGH 7.7
PyPI

CVE-2026-59221

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
HIGH 8.0
PyPI

CVE-2026-59224

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)
HIGH 7.3
PyPI

CVE-2026-59214

Open WebUI: Stored web worker XSS via Pyodide
HIGH 7.1
PyPI

CVE-2026-59219

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout
MEDIUM 4.3
PyPI

CVE-2026-59227

Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission
LOW 3.1
PyPI

CVE-2026-59226

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Browse more PyPI advisories

Learn What is SAST?

Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes