Open WebUI vulnerabilities

Open WebUI from 0.10.0 to 0.11.1 has an infinite loop vulnerability in the chat deletion helper in backend/open_webui/models/chats.py. An authenticated user can create a cyclic chat tree and delete a message, causing a synchronous infinite loop that blocks all user requests until process termination. Fixed in 0.11.1.

Open WebUI prior to 0.11.1 in POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search treated Python's globally routable address classification as proof that a destination was external. An authenticated user could make an Azure-hosted instance fetch and return content from 168.63.129.16, the Azure platform channel, as well as other reserved ranges that the standard classification did not reject.

Open WebUI from 0.10.0 until 0.11.1 in DELETE /api/v1/knowledge/{id}/delete authorized deletion against the knowledge base but then removed its administrator-owned external connection without a separate administrator check or a check for other dependent knowledge bases. A non-administrator with write access to one external knowledge base could delete shared instance configuration and make every other knowledge base using that connection unavailable.

Open WebUI from 0.10.0 to 0.11.1 fails to apply folder write-access checks when creating a new chat with a client-supplied folder_id in POST /api/chat/completions and POST /api/v1/chat/completions. An authenticated user who knows a shared folder identifier can inject a chat into a folder where they have read-only or no write access, causing the entry to appear to authorized readers. Fixed in 0.11.1.

Open WebUI from 0.9.6 until 0.11.1 in SafePlaywrightURLLoader in backend/open_webui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and async request interceptors. An authenticated user controlling authoritative DNS could return a public address to validation and an internal address to the browser, exposing responses from internal services or cloud metadata through web search or URL ingestion.

Open WebUI from 0.8.11 until 0.11.1 in src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin. Because the terminal proxy serves that content from the Open WebUI origin, an authenticated user with access to a shared terminal server could host script on a previewed port and take over a victim's account when the victim opened the preview.

Open WebUI from 0.9.5 to 0.11.1 does not verify that the calling user authored the targeted message in the channel branch of chat_completion. A channel member can replace another member's message while preserving the victim as the stored author, altering the conversation record without gaining access to other channels. Fixed in 0.11.1.

Open WebUI from 0.7.0 to 0.11.1 fails to apply metadata filter in the built-in knowledge search tool, allowing an authenticated user to enumerate identifiers, names, and descriptions of inaccessible knowledge bases from the shared collection. Document text remains separate, but metadata is exposed. Fixed in 0.11.1.

Open WebUI from 0.6.41 until 0.11.1 in get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject containing percent or underscore wildcard characters could resolve to a different stored identity, potentially selecting an administrator account and issuing the attacker that account's session; PostgreSQL deployments were not affected.

Open WebUI from 0.6.27 to 0.11.1 incorrectly captures a cookie jar in external tools, potentially leaking user session cookies to the operator of another tool server. When multiple tool servers are attached and a session or OAuth connection is processed last, requests to a different server may include the user's Open WebUI session cookies, allowing account takeover. Fixed in 0.11.1.

Open WebUI from 0.9.0 to 0.11.1 fails to invalidate the cached user record after role changes. An administrator demoted through a trusted role header or OAuth role mapping can keep an already-open Socket.IO connection and continue reading or editing every user's collaborative notes until that connection closes. Fixed in 0.11.1.

Open WebUI from 0.10.0 to 0.11.1 allows an authenticated user to place a folder under itself or one of its descendants, creating a cycle in the folder tree. The lack of visited-folder tracking during delete and read operations enables a request that consumes CPU and memory indefinitely until repaired.

Open WebUI from 0.9.0 to 0.11.1 stores the calendar event alert_minutes value without type validation, and the scheduler compares it numerically. An authenticated user with calendar permission can store a non-numeric value that raises an exception and aborts the instance-wide alert pass, suppressing all users' reminders.

In Open WebUI from 0.9.0 to 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler fetches the OIDC discovery document and signing keys before validating the logout token, causing repeated network fetches and blocking the event loop, enabling a DoS attack on a single-worker instance.

Open WebUI from 0.9.5 before 0.10.0 allows any authenticated user to overwrite message content in a channel they do not belong to (including private and DM channels) by sending a chat completion request with a channel:-prefixed chat_id and a target message_id. Fixed in version 0.10.0.

In Open WebUI from 0.10.0 until 0.11.0, the DELETE /api/v1/folders/{id} handler allowed a user with write access to a shared chat folder to permanently delete chats and messages belonging to the folder owner. The authorization check did not require ownership or administrator status, and the cascade was bound to the owner's id. A collaborator can destroy the owner's subtree or force-move chats out of it.

Open WebUI versions 0.9.6 through 0.11.0 have a DoS vulnerability in the knowledge search path. Patterns containing regex metacharacters are compiled with Python's backtracking re engine and run without time limit, allowing an attacker to pin a CPU core and block the event loop. The issue is fixed in version 0.11.0.

In Open WebUI from 0.10.0 until 0.11.0, the KatexRenderer.svelte component could store and render a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. The catch branch inserted the original math source into the page as HTML through {@html}, allowing script execution in the browser of anyone who views the message, including shared chats and channels. The viewer's session token can be stolen, and an administrator viewer can have their account taken over.

In Open WebUI version 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/{id} endpoints returned full Python tool source to authenticated non-admin read-only users. ToolResponse deliberately omitted source and specs, but ToolUserResponse permitted extra fields and handlers spread a full tool model dump into the response, re-admitting omitted fields.

Open WebUI from 0.8.8 to 0.11.0 has a vulnerability in the terminal WebSocket route that authenticates its own first-message JWT and never applies the verified-user role gate. An account with pending role, including unapproved or deactivated accounts, can open an interactive terminal session when at least one terminal server is configured. Fixed in 0.11.0.

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/open_webui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then walked forward one interval at a time to find the next run. A single FREQ=MINUTELY rule enumerates roughly a quarter-century of occurrences synchronously on the event loop that also serves scheduler, HTTP, and WebSocket traffic, and the scheduler recomputes the next run for every claimed row on each poll. This causes availability impact for every other user of the instance. This issue is fixed in 0.11.0.

Open WebUI from 0.9.6 to 0.11.0 has a vulnerability in the sync cleanup endpoint that authorizes write access to a knowledge base in the URL but acts on directory and file ids from the request body without checking ownership. A user with write access to one knowledge base can delete directories and remove file embeddings from another knowledge base. Fixed in 0.11.0.

Open WebUI from 0.8.8 until 0.11.0 accepts client-supplied knowledge attachments without filtering them against the caller's read access. Any authenticated user who knew another user's file id could have the builtin knowledge tools return indexed chunks from that file, causing a read-only cross-user confidentiality loss. This issue is fixed in 0.11.0.

Open WebUI prior to 0.11.0 resolved a hostname during URL validation and rejected private, loopback, and link-local addresses, but HTTP clients resolved the hostname again at connection time. An authenticated attacker controlling DNS could answer with a public address during validation and an internal one during connection, reaching internal services or cloud metadata, with most paths returning the response to the attacker and the OAuth path forwarding the OAuth access token. Fixed in 0.11.0.

Open WebUI from 0.9.0 until 0.11.0 has a vulnerability in the terminal file-preview serveUrl iframe branch, which always grants allow-same-origin and allow-scripts for HTML files. Any authenticated user with access to a configured terminal server could cause script execution in the Open WebUI origin, steal the victim's session token, and take over the account, with possible server-side code execution if the victim was an admin.

Open WebUI from 0.9.0 to 0.11.0 checked whether a user-supplied URL destination was globally routable by applying ipaddress.is_global to the literal IPv6 address without examining IPv4 addresses embedded in transition encodings. On a deployment with a NAT64 gateway, any verified user could wrap an internal or cloud-metadata IPv4 address in the NAT64 well-known prefix, pass the filter, and receive the internal response body through RAG URL ingestion, URL-to-markdown conversion, or web-search content retrieval.

Open WebUI from version 0.7.0 to 0.11.0 contains a vulnerability where the legacy chat-completions feature ignores the client-supplied image_generation flag and fails to re-check the image_generation permission. An authenticated user with revoked image-generation permission can still consume the configured image provider through chat completions.

Open WebUI versions 0.9.6 through 0.11.0 allow an authenticated user to cancel another user's in-flight tasks (e.g., model response generation) by knowing the chat ID. This occurs because the delete operation cancels tasks before checking permissions. The issue is fixed in version 0.11.0.

Open WebUI from 0.8.0 until 0.11.0 has a vulnerability in the OAuth token exchange mechanism. When ENABLE_OAUTH_TOKEN_EXCHANGE=True, /oauth/{provider}/token/exchange accepts a raw provider access token and validates it without confirming which OAuth client the token was issued to. Anyone holding an access token for any client registered with the same provider could exchange it for an Open WebUI session as that token user.

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete handlers accepted any caller holding write access on the channel without checking that the caller wrote the message. Because write access is the same grant a member needs to post, any ordinary participant in a shared standard channel could rewrite or permanently delete another participant message, while group and direct message handlers enforced authorship. This issue is fixed in 0.11.0.

Open WebUI from 0.6.34 to 0.11.0 renders vega and vega-lite fenced code blocks in chat content by building a Vega view without a restricted resource loader. A user who can place such a block can make another user's browser issue attacker-chosen outbound GET requests and read responses from same-origin or CORS-permissive targets.

Open WebUI from 0.9.6 to 0.11.0, with WEB_LOADER_ENGINE=playwright, validates only the top-level page request and lets sub-resource requests pass unvalidated. A page supplied by an authenticated user can use JavaScript to reach blocked internal addresses, and returned DOM can include data read from those addresses in web-search or RAG output.

The vulnerability in open-webui before version 0.3.14 is due to a misconfigured CORS policy that allows arbitrary origins (allow_origins=*) and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the open-webui instance by crafting malicious cross-site requests when an admin user visits attacker-controlled websites.

Open WebUI before version 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow. The MIME type of the profile picture URL is inferred from the file extension rather than the Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs. Authenticated users visiting the profile image endpoint receive attacker-controlled SVG content, enabling script execution in the same origin to steal authentication tokens and achieve account takeover.

A vulnerability in Open WebUI before version 0.10.0 allows bypassing proxy path normalization by encoding the '../' sequence nine times in percent-encoded format. The _sanitize_proxy_path function decodes paths only eight times, enabling an attacker to access files outside the allowed directory.

In Open WebUI from version 0.6.16 before 0.10.0, the Socket.IO server is configured with always_connect=True, and the ydoc:awareness:update and ydoc:document:leave handlers accept collaborative-document events without requiring an authenticated user, allowing unauthorized manipulation of document collaboration state.

In Open WebUI from version 0.8.11 before 0.10.0, the POST /api/v1/images/edit endpoint only required a verified account but did not enforce the global image-edit switch or per-user image-generation permission. This allowed a non-admin user to invoke server-side image editing with administrator-configured provider credentials.

A vulnerability in Open WebUI versions from 0.9.0 before 0.10.0 allows deactivated users to continue scheduled model execution. The execute_automation function rehydrated automation owners without rechecking their activity status, and check_model_access only enforced private-model grants for the exact user role.

In Open WebUI from version 0.8.12 before 0.10.0, an authenticated non-admin user with read access to an arena wrapper model can bypass access control to a restricted underlying model via task endpoints like /api/v1/tasks/moa/completions. The normal chat route checks the arena model before dispatching, while the task route calls generate_chat_completion() directly with bypass_filter=True, skipping the submodel's access check.

In Open WebUI prior to 0.10.0, the WebSocket terminal URL was built from an unencoded session_id, allowing query injection to impersonate another user. The HTTP proxy also forwarded X-User-Id without integrity checks, enabling identity manipulation.

In Open WebUI prior to version 0.10.0, the WEB_FETCH_FILTER_LIST matching compared configured host entries against URL strings, allowing bypass of blocklists via path-based entries (e.g., !internal.example.com) and sibling-domain matches that did not reflect the intended hostname policy.

A vulnerability in Open WebUI versions 0.7.0 through 0.10.0 allows a regular channel participant to retrieve sensitive settings of other users, including API keys and webhook configurations, via a GET request to /api/v1/channels//members. The issue is fixed in version 0.10.0.

A vulnerability in Open WebUI before version 0.10.0 allowed a ReDoS (Regular Expression Denial of Service) attack by sending a specially crafted chat message containing <$ without a closing >. The SKILL_MENTION_RE and strip_re regular expressions in backend/open_webui/utils/middleware.py caused quadratic backtracking, blocking the asyncio event loop.

In Open WebUI before version 0.10.0 with Redis configured, real-time connection authentication (Socket.IO, WebSocket) used decode_token without the Redis-backed is_valid_token revocation check, allowing revoked JWTs to continue authenticating.

In Open WebUI prior to version 0.10.0, the /api/v1/auths/signin endpoint allowed account enumeration via timing side-channel. Requests for registered users were measurably slower (due to bcrypt verification) than for non-existent emails, enabling unauthenticated attackers to enumerate valid accounts.

In Open WebUI prior to version 0.10.0, the file upload path accepted the metadata.knowledge_id parameter and automatically linked uploaded files to a target knowledge base without applying the write-access check used by /api/v1/knowledge//file/add, allowing read-only knowledge-base users to add arbitrary files.

A vulnerability in Open WebUI before version 0.10.0 allows authenticated users to execute Python code or tools in another user's session. An attacker can exploit Socket.IO events to hijack a victim's session after learning their socket ID.

In Open WebUI prior to version 0.10.0, a vulnerability exists where channel thread parent and reply handling did not bind parent_id to the channel in the URL. This allows an authenticated user to reference a message from another private or DM channel and disclose thread context across channels.

Open WebUI prior to 0.10.0 runs client-side Python with Pyodide in a same-origin web worker, allowing stored chat payloads using pyodide.http.pyfetch or the js module fetch and XMLHttpRequest APIs to issue authenticated same-origin requests when a victim clicks Run, which can reach admin-only endpoints and execute server-side code through configured tools.

In Open WebUI versions from 0.6.27 before 0.10.0, the get_all_models handlers in routers/openai.py and routers/ollama.py passed a lambda to the aiocache key instead of key_builder, causing permission-filtered per-user model lists to share a static cache entry. This exposes one user's model list to another caller during the TTL window.