CVE-2026-88002

Open WebUI from 0.9.5 to 0.11.1 fails to reapply WEB_FETCH_FILTER_LIST or private-address controls to HTTP redirect destinations when AIOHTTP_CLIENT_ALLOW_REDIRECTS is enabled. An authenticated user can redirect fetches to excluded hosts, loopback, private networks, or cloud metadata services, and route content into various features. Fixed in 0.11.1.

Open WebUI from 0.10.0 to 0.11.1 has an infinite loop vulnerability in the chat deletion helper in backend/open_webui/models/chats.py. An authenticated user can create a cyclic chat tree and delete a message, causing a synchronous infinite loop that blocks all user requests until process termination. Fixed in 0.11.1.

Open WebUI prior to 0.11.1 in POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search treated Python's globally routable address classification as proof that a destination was external. An authenticated user could make an Azure-hosted instance fetch and return content from 168.63.129.16, the Azure platform channel, as well as other reserved ranges that the standard classification did not reject.

Open WebUI from 0.10.0 until 0.11.1 in DELETE /api/v1/knowledge/{id}/delete authorized deletion against the knowledge base but then removed its administrator-owned external connection without a separate administrator check or a check for other dependent knowledge bases. A non-administrator with write access to one external knowledge base could delete shared instance configuration and make every other knowledge base using that connection unavailable.

Open WebUI from 0.10.0 to 0.11.1 fails to apply folder write-access checks when creating a new chat with a client-supplied folder_id in POST /api/chat/completions and POST /api/v1/chat/completions. An authenticated user who knows a shared folder identifier can inject a chat into a folder where they have read-only or no write access, causing the entry to appear to authorized readers. Fixed in 0.11.1.

Open WebUI from 0.9.6 until 0.11.1 in SafePlaywrightURLLoader in backend/open_webui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and async request interceptors. An authenticated user controlling authoritative DNS could return a public address to validation and an internal address to the browser, exposing responses from internal services or cloud metadata through web search or URL ingestion.

Open WebUI from 0.8.11 until 0.11.1 in src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin. Because the terminal proxy serves that content from the Open WebUI origin, an authenticated user with access to a shared terminal server could host script on a previewed port and take over a victim's account when the victim opened the preview.

Open WebUI from 0.9.5 to 0.11.1 does not verify that the calling user authored the targeted message in the channel branch of chat_completion. A channel member can replace another member's message while preserving the victim as the stored author, altering the conversation record without gaining access to other channels. Fixed in 0.11.1.

Open WebUI from 0.7.0 to 0.11.1 fails to apply metadata filter in the built-in knowledge search tool, allowing an authenticated user to enumerate identifiers, names, and descriptions of inaccessible knowledge bases from the shared collection. Document text remains separate, but metadata is exposed. Fixed in 0.11.1.

Open WebUI from 0.6.41 until 0.11.1 in get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject containing percent or underscore wildcard characters could resolve to a different stored identity, potentially selecting an administrator account and issuing the attacker that account's session; PostgreSQL deployments were not affected.