Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
145 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Base Model Routing Bypasses Access Control via Model Chaining Affected Component Model chaining via basemodelid: - backend/openwebui/routers/models.py (lines 170-214, createnewmodel) - backend/openwebui/routers/models.py (lines 254-308, importmodels) - backend/openwebui/main.py (lines 1696-1711, base model resolution in chat completion) - backend/openwebui/routers/openai.py (lines 1032-1037, base model payload rewrite) - backend/openwebui/routers/ollama.py (lines 1086-1090, base model payload rewrite) - backend/openwebui/utils/models.py (line 380, checkmodelaccess — checks user-facing model only) Affected Versions Current main branch (commit 6fdd19bf1) and likely all versions with the model chaining (basemodelid) feature. Description Open WebUI supports model composition via basemodelid: a user-defined model (e.g., "Cheap Assistant") can reference an existing base model (e.g., "gpt-4-turbo-restricted") that provides the actual inference capability. When a user queries the composed…
Recommended action: Upgrade to 0.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Redis Cache Keys toolservers and terminalservers Missing Instance Prefix Enable Cross-Instance Cache Poisoning Affected Component Tool server and terminal server Redis cache: - backend/openwebui/utils/tools.py (line 841, toolservers SET) - backend/openwebui/utils/tools.py (line 850, toolservers GET) - backend/openwebui/utils/tools.py (line 976, terminalservers SET) - backend/openwebui/utils/tools.py (line 986, terminalservers GET) Affected Versions Current main branch (commit 6fdd19bf1) and likely all versions since the tool server / terminal server Redis cache was introduced. Description Open WebUI uses a REDISKEYPREFIX (default open-webui) to namespace Redis keys, allowing multiple instances to safely share a single Redis backend. Every Redis key in the codebase uses this prefix — except the toolservers and terminalservers keys in utils/tools.py, which use bare key names. When two or more Open WebUI instances share a Redis database (a supported and documented deployment pattern,…
Recommended action: Upgrade to 0.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access Affected Component Socket.IO session state and role-check callsites: - backend/openwebui/socket/main.py (lines 330-351, connect handler — role snapshotted into SESSIONPOOL) - backend/openwebui/socket/main.py (lines 393-398, heartbeat handler — does not refresh role) - backend/openwebui/socket/main.py (line 538, ydoc:document:join — uses cached role for admin check) - backend/openwebui/socket/main.py (line 611, documentsavehandler — uses cached role for admin check) - backend/openwebui/routers/users.py (lines 557-633, role update — does not invalidate SESSIONPOOL) - backend/openwebui/routers/users.py (line 641, user delete — does not invalidate SESSIONPOOL) Affected Versions Current main branch (commit 6fdd19bf1) and likely all versions with the collaborative document (Yjs) Socket.IO handlers. Description When a user connects via Socket.IO, the connect handler authenticates them via JWT and stores…
Recommended action: Upgrade to 0.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts Affected Component Folder creation endpoint and form model: - backend/openwebui/models/folders.py (lines 72-77, FolderForm with extra='allow') - backend/openwebui/models/folders.py (lines 95-106, insertnewfolder dict construction) - backend/openwebui/routers/folders.py (line 119, createfolder endpoint) Affected Versions Current main branch (commit 6fdd19bf1) and likely all versions since FolderForm adopted extra='allow'. Description FolderForm uses modelconfig = ConfigDict(extra='allow'), which permits arbitrary fields to pass through Pydantic validation and be included in modeldump(excludeunset=True). In insertnewfolder, the server-assigned userid is placed at the start of the dict and then overwritten by the spread of form data: Because FolderModel declares userid: str as a real field (not just a form extra), any attacker-supplied userid in the POST body is accepted by the model and…
Recommended action: Upgrade to 0.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
LDAP Empty Password Authentication Bypass Affected Component LDAP authentication endpoint: - backend/openwebui/routers/auths.py (lines 468-477, user bind with empty password) - backend/openwebui/models/auths.py (lines 58-60, LdapForm model) Affected Versions Current main branch (commit 6fdd19bf1) and likely all versions with LDAP authentication support. Description The LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. Per RFC 4513 Section 5.1.2, a Simple Bind with a valid DN and an empty password constitutes an "unauthenticated simple authentication" — many LDAP servers (including OpenLDAP in default configuration and some Active Directory setups) return success (resultCode 0) for this operation. The LdapForm Pydantic model accepts password: str with no minimum length constraint, so an empty string passes validation. The subsequent Connection.bind() call succeeds on vulnerable LDAP servers,…
Recommended action: Upgrade to 0.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
[!IMPORTANT] Relationship to CVE-2024-7990 CVE-2024-7990 (issued by huntr.dev, March 2025) describes a stored XSS in the same field — the model description — but exploits a different bypass mechanism: a second-order injection through the sanitizeResponseContent function's video-tag placeholder restoration logic in v0.3.x. That bypass was closed in v0.4.0 by removing the video exemption from the sanitizer. The vulnerability described in this advisory is structurally distinct: a markdown-link payload with a javascript: URI passes through sanitizeResponseContent unchanged (no angle brackets), is then parsed by marked.parse() into an <a href="javascript:..." element, and rendered live by {@html}. This is a pipeline-ordering flaw where the dangerous construct is introduced after sanitization completes. Removing the video exemption has no effect on this primitive. Affected range: v0.3.5 through v0.8.12 inclusive. Fixed in: v0.9.0 (commit 5eab125, which wraps marked.parse() output in…
Recommended action: Upgrade to 0.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Broken Access Control in Tool Valves Open WebUI supports function calling through "Tools". Function calling allows an LLM to reliably connect to external tools and interact with external APIs. Exemplary use-cases include connecting to an internal knowledge base, retrieving emails from an exchange server, or retrieving order data from a shop backend. These interactions often require the LLM to authenticate against backend services using API keys specifically created for a technical (Open WebUI) user. To simplify configuration and secret handling, Open WebUI implements "Valves" and "UserValves" that allow users and administrators to input dynamic details like API keys or configuration options. Valves have the following distinction: - Valves: Configurable by admins only. - UserValves: Configurable by any user. The Tool Valves endpoint does not properly restrict read access to the valve. This allows a low privileged user to access all data contained within the valve. In the worst…
Recommended action: Upgrade to 0.8.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Any authenticated user can read other users' private memories via /api/v1/retrieval/query/collection Details Vulnerability 1: Missing authorization in collection querying In backend/openwebui/routers/retrieval.py, the querycollectionhandler function accepts a list of collectionnames but performs no ownership validation: Collection names follow predictable patterns: - User files: file-{FILEUUID} - User memories: user-memory-{USERUUID} (requires Memory experimental feature) PoC Environment: Open WebUI v0.8.3, default configuration. Setup: 1. Register two users: admin (first user) and attacker (second user). 2. As admin, upload a PDF document through chat. 3. As admin, enable Memory (Settings → Personalization → Memory) and add some memories. Exploitation — Step 1: Enumerate all users Response reveals all users including admin's UUID, email, and role: <img width="1340" height="731" alt="1poc - users"…
Recommended action: Upgrade to 0.8.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An access control check is missing when deleting a file from a knowledge base. The only check being done is that the user has write access to the knowledge base (or is admin), but NOT that the file actually belongs to this knowledge base. It is thus possible to delete arbitrary files from arbitrary knowledge bases (as long as one knows the file id) Details The source code at https://github.com/open-webui/open-webui/blob/main/backend/openwebui/routers/knowledge.py#L803 does not properly validate that the file being deleted belongs to the current knowledge base: PoC Victim has a knowledge base with a file (id: 9db6dcee-bb3b-483e-aaf3-310fda366af1) Attacker creates their own collection (id: dde9e2b6-21c9-4aa1-a1cf-8cb0e4392f2b) Attacker deletes the victim file from their own collection: The file is then deleted from the victim's knowledge base. Impact Arbitrary file deletion
Recommended action: Upgrade to 0.8.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Any authenticated user can overwrite any file's content by ID through the POST /api/v1/retrieval/process/files/batch endpoint. The endpoint performs no ownership check, so a regular user with read access to a shared knowledge base can obtain file UUIDs via GET /api/v1/knowledge/{id}/files and then overwrite those files, escalating from read to write. The overwritten content is served to the LLM via RAG, meaning the attacker controls what the model tells other users. Details The processfilesbatch() function in backend/openwebui/routers/retrieval.py appears to be designed as an internal helper. The knowledge base router (addfilestoknowledgebatch() in knowledge.py) imports and calls it directly after performing its own ownership and access control checks. The frontend never calls the retrieval route directly; all legitimate UI flows go through the knowledge base wrapper. However, the function is also exposed as a standalone HTTP endpoint via @router.post(...). This direct route…
Recommended action: Upgrade to 0.8.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An unsanitised filename field in the speech-to-text transcription endpoint allows any authenticated non-admin user to trigger a FileNotFoundError whose message — including the server's absolute DATADIR path — is returned verbatim in the HTTP 400 response body, confirming information disclosure on all default deployments. Details backend/openwebui/routers/audio.py:1197 extracts a file extension from the raw multipart filename using file.filename.split(".")[-1] with no path sanitisation. The result is concatenated into a filesystem path and passed to open(): If the filename is audio./etc/passwd, split(".")[-1] yields /etc/passwd and the assembled path becomes: open() fails with FileNotFoundError. The outer except block at line 1231 returns the exception via ERRORMESSAGES.DEFAULT(e), leaking the full absolute path in the response body. The MIME-type guard at line 1190 checks Content-Type (a separate multipart field) and does not constrain filename. Setting Content-Type:…
Recommended action: Upgrade to 0.8.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. No special permissions beyond basic authentication are required. Details The vulnerability exists in the /api/v1/retrieval/process/web endpoint located in backend/openwebui/routers/retrieval.py at lines 1758-1767. Vulnerable code: @router.post("/process/web") def processweb( request: Request, formdata: ProcessUrlForm, user=Depends(getverifieduser) ): try: collectionname = formdata.collectionname if not collectionname: collectionname = calculatesha256string(formdata.url)[:63] content, docs = getcontentfromurl(request, formdata.url) ← SSRF vulnerability The formdata.url parameter is passed directly to getcontentfromurl() without any validation.…
Recommended action: Upgrade to 0.6.37 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Open WebUI v0.6.33 and below contains a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) execute events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users. Details ROOT CAUSE ANALYSIS: Open WebUI's Direct Connections feature allows users to add external OpenAI-compatible model servers without proper validation of the Server-Sent Events (SSE) these servers emit. VULNERABLE COMPONENT: Frontend SSE Event Handler The frontend JavaScript code processes SSE events from external servers and specifically handles an execute event type that…
Recommended action: Upgrade to 0.6.35 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prompt body is assigned to the DOM sink .innerHtml without sanitisation. Any user with permissions to create prompts can abuse this to plant a payload that could be triggered by other users if they run the corresponding / command to insert the prompt. Details The affected line is https://github.com/open-webui/open-webui/blob/7a83e7dfa367d19f762ec17cac5e4a94ea2bd97d/src/lib/components/common/RichTextInput.svelte#L348 User controlled HTML from the prompt body is assigned to tempDiv.innerHTML without (meaningful) sanitisation. marked.parse introduces some character limitations but does not sanitise the content, as stated in their README. <img width="1816" height="498" alt="image" src="https://github.com/user-attachments/assets/bd0980fc-ad87-460a-94b8-02bc94bea1a2" / PoC Create a custom prompt as follows: <img width="3006"…
Recommended action: Upgrade to 0.6.35 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability. This can be exploited by an authenticated user to overwrite critical files within the Docker container, potentially leading to remote code execution as the root user.
Recommended action: Upgrade to 0.5.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability in open-webui/open-webui version 79778fa allows an attacker to cause a Denial of Service (DoS) by uploading a file with a malformed multipart boundary. By appending a large number of characters to the end of the multipart boundary, the server continuously processes each character, rendering the application inaccessible. This issue can prevent all users from accessing the application until the server recovers.
Recommended action: Upgrade to 0.4.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability in open-webui/open-webui versions <= 0.3.8 allows remote code execution by non-admin users via Cross-Site Request Forgery (CSRF). The application uses cookies with the SameSite attribute set to lax for authentication and lacks CSRF tokens. This allows an attacker to craft a malicious HTML that, when accessed by a victim, can modify the Python code of an existing pipeline and execute arbitrary code with the victim's privileges.
Recommended action: Upgrade to 0.3.33 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In version 0.3.32 of open-webui, the application uses a vulnerable version of the starlette package through its dependency on fastapi. The starlette package versions <=0.49 are susceptible to uncontrolled resource consumption, which can be exploited to cause a denial of service through memory exhaustion. This issue is addressed in fastapi version 0.115.3.
Recommended action: Upgrade to 0.5.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint `http://0.0.0.0:3000/api/v1/memories/{id}/update`, where the decentralization design is flawed, allowing attackers to edit other users' memories without proper authorization.
Recommended action: Upgrade to 0.6.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.
Recommended action: Upgrade to 0.3.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.