CVE-2026-0767
Low risk· EPSS 17%Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
This CVE has been rejected. Open WebU's investigation showed that this describes the behavior of plain HTTP rather than a defect in the product. TLS termination is the operator's deployment decision, as it is for any backend that speaks HTTP, and not a security issue.
Risk Assessment
Since the CVE is rejected, it does not pose a security threat. Organizations do not need to take remediation actions.
Recommendation
No action is required. However, ensure that TLS termination is properly configured in your deployment environment.
Other vulnerabilities in Open WebU
See all- CVE-2026-0766Very high risk· EPSS 98%
This CVE has been rejected. Open WebU's investigation showed that this is intended functionality of the Plugins extension system, where users with the relevant permission author Python that the server executes by design, and not a security issue.
- CVE-2026-0765Elevated risk· EPSS 74%
This CVE has been rejected. Open WebU's investigation showed that this is intended functionality of the Plugins extension system, where users with the relevant permission author Python that the server executes by design, and not a security issue.
Original NVD description (English source)
Rejected reason: Open WebU's investigation showed that this describes the behavior of plain HTTP rather than a defect in the product. TLS termination is the operator's deployment decision, as it is for any backend that speaks HTTP, and not a security issue. https://docs.openwebui.com/security/vendor-dispositions/cve-2026-0767