VYPR
patchPublished Sep 10, 2026· Updated Sep 11, 2026· 1 source

Open WebUI: 18 Vulnerabilities Disclosed, Patch Released in Version 0.11.1

Key findings • 18 vulnerabilities disclosed for Open WebUI between September 9-10, 2026, patched in version 0.11.1. • High-severity flaws include SQL injection (CVE-2026-87016), XSS risks (CV…

Key findings

On September 9-10, 2026, a batch of 18 vulnerabilities was disclosed for Open WebUI, an AI platform. These vulnerabilities, ranging in severity from Medium to High, were patched in version 0.11.1. The disclosures highlight several security weaknesses across different functionalities of the platform, including authentication, data handling, and external integrations.

Several vulnerabilities stem from improper handling of user roles and permissions. CVE-2026-88006 (Medium) and CVE-2026-88005 (Medium) relate to the OAuth token exchange endpoint, which, in certain versions, issued sessions without proper role management or email domain allowlisting. Additionally, CVE-2026-87016 (High) describes an SQL injection vulnerability in user retrieval functions that could be exploited via specially crafted OAuth subject identifiers. CVE-2026-87997 (Medium) and CVE-2026-87994 (Medium) point to issues with access control checks when handling chat messages and folder operations, respectively.

Data integrity and processing are also affected. CVE-2026-88002 (Medium) involves a flaw in message-chain reconstruction where visited entries were tracked incorrectly, potentially allowing manipulation of chat history. CVE-2026-88000 (Medium) details a vulnerability in deleting messages within a chat history that did not properly record visited message identifiers, possibly leading to incomplete deletions. CVE-2026-87013 (Medium) highlights a vulnerability in folder management that allowed circular parent-child relationships, which could interfere with deletion operations.

Concerns regarding external interactions and data fetching are present. CVE-2026-87999 (High) and CVE-2026-87996 (High) involve vulnerabilities in processing web retrieval requests. The former allowed the platform to treat globally routable addresses as safe without proper validation, while the latter had issues with URL hostname validation in conjunction with Playwright, potentially leading to SSRF or other attacks. CVE-2026-87015 (Medium) describes a flaw in how cookie jars were handled for external tool calls, which could lead to session or system information leakage when multiple tool servers were attached. CVE-2026-87014 (Medium) addresses an issue where role synchronization updates did not invalidate cached user records, potentially leading to stale permissions.

Furthermore, vulnerabilities related to cross-site scripting (XSS) and information exposure were identified. CVE-2026-87995 (High) involves rendering terminal port content within an iframe sandbox that included both allow-scripts and allow-same-origin, creating a risk of XSS or data exfiltration. CVE-2026-87012 (Medium) points to improper type validation for calendar event alert minutes, which could be exploited by authenticated users. CVE-2026-87011 (High) details an unauthenticated logout handler that fetched sensitive OIDC information before validating the logout token, potentially exposing signing keys. Finally, CVE-2026-88001 (Medium) describes a server-side web fetch vulnerability where redirect destinations were not properly filtered, allowing for potential redirection attacks.

All identified vulnerabilities were addressed in Open WebUI version 0.11.1. Users are strongly advised to update to this version to mitigate the risks associated with these security flaws. The batch of disclosures underscores the importance of rigorous security testing and timely patching for AI platforms handling sensitive user data and interactions.

Synthesized by Vypr AI