Open WebUI: 17 Vulnerabilities Disclosed Together, Patched in 0.11.0

Key findings

17 vulnerabilities disclosed for Open WebUI on August 4, 2026, all patched in version 0.11.0.
High severity flaws include unauthorized data deletion, script execution via iframes, and OAuth token exchange vulnerabilities.
Multiple vulnerabilities stem from improper access control and data validation flaws in API handlers and user-facing features.
Issues range from data exposure and script injection to incorrect automation scheduling and network address validation errors.
Users are urged to update to Open WebUI 0.11.0 to address these critical security weaknesses.

On August 4, 2026, a significant batch of 17 vulnerabilities was disclosed for Open WebUI, an AI platform. These vulnerabilities, spanning a range of severities from Low to High, were all patched in version 0.11.0. The disclosures highlight several security weaknesses within the platform's handling of user data, API endpoints, and internal processing logic.

Several vulnerabilities revolve around improper access control and data handling. CVE-2026-70494, a High severity flaw, allowed users with write access to shared chat folders to permanently delete chats and messages within those folders. Similarly, CVE-2026-70488 (Medium) authorized write access to a knowledge base based on the URL but failed to verify if the supplied directory and file IDs belonged to that specific knowledge base. CVE-2026-70481 (Medium) involved message update and delete handlers that accepted any user with write access to a channel, regardless of whether they authored the message.

Other issues relate to API endpoint security and data exposure. CVE-2026-70491 (Medium) saw authenticated non-admin read-only users receiving full Python tool source code via specific API endpoints. CVE-2026-70490 (Medium) involved an authentication bypass in the terminal WebSocket route, where the first message's JWT was authenticated but the verified-user role gate was not applied. CVE-2026-70482 (High) allowed a raw provider access token to be accepted and validated via the OAuth token exchange endpoint without confirming the originating OAuth client.

Security concerns also extended to how Open WebUI handles external inputs and rendering. CVE-2026-70492 (High) involved a math block in chat messages that could cause a stack overflow in the KaTeX renderer. CVE-2026-70493 (Medium) allowed chat participants to specify patterns for grepping knowledge files, with patterns containing specific characters leading to unintended behavior. CVE-2026-54020 (Medium) had an authenticated attacker controlling a hostname that was resolved twice, once for validation and again at connection time, potentially bypassing restrictions on private, loopback, and link-local addresses. CVE-2026-70486 (High) granted allow-same-origin and allow-scripts for HTML files served from the application origin in the terminal file-preview iframe, potentially allowing script execution. CVE-2026-70479 (High) with the Playwright web loader allowed sub-resource requests to pass unvalidated, enabling JavaScript execution within a user-supplied page. CVE-2026-70480 (Medium) rendered vega and vega-lite fenced code blocks without a restricted resource loader, allowing potential cross-site scripting.

The batch also included vulnerabilities related to automation and network address validation. CVE-2026-70489 (Medium) had an issue with automation recurrence parsing where minutely and hourly rules were anchored to a fixed date and walked forward, potentially leading to incorrect scheduling. CVE-2026-70485 (High) failed to properly validate embedded IPv4 addresses within transition encodings when checking for globally routable IPv6 addresses. CVE-2026-70484 (Medium) involved legacy chat-completions features that trusted a client-supplied image_generation flag without re-checking permissions. Finally, CVE-2026-70483 (Low) allowed any authenticated user who knew another user's chat ID to cancel that user's in-flight tasks before verifying deletion permissions.

All 17 vulnerabilities were addressed in Open WebUI version 0.11.0. Users are strongly advised to update to this version to mitigate the risks associated with these security flaws. The coordinated disclosure of these issues on a single day underscores the importance of prompt patching for users of the Open WebUI platform.

CVEs addressed in this batch include: