Open WebUI: 19 Vulnerabilities Disclosed, Ranging from Privilege Escalation to XSS
A batch of 19 vulnerabilities, including privilege escalation and XSS flaws, were disclosed for Open WebUI, affecting versions prior to 0.11.4.
Key findings
- 19 vulnerabilities disclosed for Open WebUI on October 12, 2026, patched in version 0.11.4.
- High-severity privilege escalation (CVE-2026-109572) and cross-origin token theft (CVE-2026-109286) are among the disclosed flaws.
- Multiple stored XSS vulnerabilities allow script execution via crafted messages, citations, and attachments.
- Denial-of-service and resource exhaustion flaws can stall the application or consume excessive memory.
- Various authorization bypasses and improper access control issues affect file and terminal access.
- Users must update to Open WebUI 0.11.4 or later to address these security risks.
On October 12, 2026, a significant batch of 19 vulnerabilities was disclosed for Open WebUI, affecting versions prior to 0.11.4. These vulnerabilities, ranging in severity from medium to high, were all patched in version 0.11.4, and their coordinated disclosure highlights a critical need for users to update their installations promptly. The vulnerabilities span various attack vectors, including privilege escalation, cross-site scripting (XSS), denial of service (DoS), information disclosure, and authorization bypasses.
Several vulnerabilities revolve around cross-site scripting (XSS), a common web application flaw. CVE-2026-109300, a stored XSS in the Markdown renderer, allows authenticated users to execute scripts by crafting malicious messages. Similarly, CVE-2026-109291 enables script execution through crafted chat citations containing javascript: URLs, while CVE-2026-109290 permits script execution via crafted DOCX attachments. CVE-2026-109288 also involves stored XSS, where authenticated users can embed javascript: links in shared chats to steal JWTs.
Denial of Service (DoS) and resource exhaustion vulnerabilities are also present. CVE-2026-109299 and CVE-2026-109297 detail DoS flaws related to automation recurrence rules and file search patterns, respectively, allowing authenticated users to stall the instance or server workers. CVE-2026-109294 describes an uncontrolled resource consumption vulnerability where authenticated users can exhaust server memory by providing compressed remote image URLs.
Privilege escalation and authorization bypasses represent another significant theme. CVE-2026-109572, a high-severity vulnerability, allows authenticated users to escalate privileges through the terminal proxy, accessing the Terminals administrator API. CVE-2026-109296 involves a missing authorization flaw enabling authenticated users to access disabled model provider backends. CVE-2026-109289 permits deactivated users to continue executing terminal commands, and CVE-2026-109283 bypasses authorization in the OAuth token exchange endpoint. CVE-2026-109287 and CVE-2026-109285 involve improper access control related to knowledge base files, allowing unauthorized access to or manipulation of files. CVE-2026-109284 allows users with read-only access to fork chats in restricted folders.
Information disclosure vulnerabilities are also noted. CVE-2026-109293 allows authenticated non-admin users with tool export permission to obtain tool source code. CVE-2026-109292 enables destination servers to obtain user session cookies on OAuth-mode connections. CVE-2026-109286, a high-severity vulnerability, allows any website to steal a user's session token through cross-origin message handling.
All these vulnerabilities were addressed in Open WebUI version 0.11.4. Users are strongly advised to update to this version or later to mitigate the risks associated with these numerous security flaws. The coordinated disclosure of these 19 CVEs underscores the importance of timely patching and security vigilance for Open WebUI users.
Key findings include:
- A high-severity privilege escalation vulnerability (CVE-2026-109572) allows authenticated users to access sensitive APIs.
- Multiple stored cross-site scripting (XSS) vulnerabilities (e.g., CVE-2026-109300, CVE-2026-109291, CVE-2026-109290) enable script execution within user sessions.
- Several denial-of-service (DoS) and resource exhaustion vulnerabilities (e.g., CVE-2026-109299, CVE-2026-109294) can stall the application or consume excessive memory.
- A critical cross-origin message handling vulnerability (CVE-2026-109286) can lead to session token theft.
- All 19 disclosed vulnerabilities are fixed in Open WebUI version 0.11.4.
- The batch includes various authorization bypasses and improper access control flaws affecting different features.
CVE IDs mentioned in the article: CVE-2026-109572, CVE-2026-109300, CVE-2026-109299, CVE-2026-109298, CVE-2026-109297, CVE-2026-109296, CVE-2026-109295, CVE-2026-109294, CVE-2026-109293, CVE-2026-109292, CVE-2026-109291, CVE-2026-109290, CVE-2026-109289, CVE-2026-109288, CVE-2026-109287, CVE-2026-109286, CVE-2026-109285, CVE-2026-109284, CVE-2026-109283.