CVE-2026-0766
Very high risk· EPSS 98%Exploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
This CVE has been rejected. Open WebU's investigation showed that this is intended functionality of the Plugins extension system, where users with the relevant permission author Python that the server executes by design, and not a security issue.
Risk Assessment
Since the CVE is rejected, it does not pose a security threat. Organizations do not need to take remediation actions.
Recommendation
No action is required. However, review the vendor's documentation on the extension system to understand intended permissions.
Other vulnerabilities in Open WebU
See all- CVE-2026-0767Low risk· EPSS 17%
This CVE has been rejected. Open WebU's investigation showed that this describes the behavior of plain HTTP rather than a defect in the product. TLS termination is the operator's deployment decision, as it is for any backend that speaks HTTP, and not a security issue.
- CVE-2026-0765Elevated risk· EPSS 74%
This CVE has been rejected. Open WebU's investigation showed that this is intended functionality of the Plugins extension system, where users with the relevant permission author Python that the server executes by design, and not a security issue.
Original NVD description (English source)
Rejected reason: Open WebU's investigation further investigation showed that this is intended functionality of the Plugins extension system, in which users granted the relevant permission author Python that the server executes by design, and not a security issue. https://docs.openwebui.com/security/vendor-dispositions/cve-2026-0766
Vulnerability data from NVD (NIST) · CISA KEV · EPSS