CVE-2026-54007
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the chat message listener allows non-same-origin input:prompt and action:submit messages, so an external site can set prompt text and trigger submitPrompt() in an authenticated victim session. I validated this with a cross-origin attacker page that auto-posted messages and caused unauthorized POST /api/v1/chats/new and POST /api/chat/completions requests containing attacker-controlled prompts. This enables cross-site forced actions and model/tool execution under victim privileges without consent. This vulnerability is fixed in 0.9.6.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
open-webuiPyPI | < 0.9.6 | 0.9.6 |
Affected products
2cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*range: <0.9.6
- (no CPE)range: <0.9.6
Patches
Vulnerability mechanics
References
5- github.com/open-webui/open-webui/security/advisories/GHSA-3vv5-8xxp-4f55nvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-3vv5-8xxp-4f55ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-54007ghsaADVISORY
- github.com/pypa/advisory-database/tree/main/vulns/open-webui/PYSEC-2026-2695.yamlghsaWEB
- pypi.org/project/open-webuighsaWEB
News mentions
1- Open WebUI: 16 CVEs Disclosed in Single-Day Batch, Many Bypassing Earlier PatchesVypr Intelligence · Jun 17, 2026