VulertSecurity VulertSecurity

Vulnerability Database · PyPI · open-webui · Version

open-webui 0.4.1

0.4.1 is affected by 230 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 0.12.3.

Critical 2 High 111 Medium 106 Low 11 Unrated 0

All open-webui versions & vulnerabilities → Search the database for this package →
Released 20 Nov 2024 Licence non-standard Also known from other sources 0 Newer releases 170 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

open-webui 0.4.1 vulnerabilities

230 vulnerabilities cover open-webui 0.4.1. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-44551: Open WebUI LDAP Empty Password Authentication Bypass Vulnerability 9.1 critical 0.9.0 29 Jun 2026
CVE-2026-44551: Open WebUI LDAP Empty Password Authentication Bypass Vulnerability 9.1 critical 0.9.0 08 May 2026
CVE-2026-45672: Open WebUI Code Execution Bypass Vulnerability 8.8 high 0.8.12 13 Jul 2026
CVE-2026-45672: Open WebUI Arbitrary Code Execution Bypass Despite Disabled Setting 8.8 high 0.8.12 14 May 2026
CVE-2026-54011: Open WebUI Stored XSS Vulnerability in Mermaid Markdown Preview 8.7 high 0.9.6 13 Jul 2026
CVE-2026-45315: Open WebUI Stored XSS via Attacker-Controlled File Extension in Audio Transcriptions 8.7 high 0.9.3 13 Jul 2026
CVE-2026-44552: Open WebUI Redis Cache Keys Vulnerability Leading to Cross-Instance Cache Poisoning 8.7 high 0.9.0 13 Jul 2026
CVE-2025-64495: Open WebUI Stored DOM XSS Vulnerability Leading to ATO/RCE 8.7 high 0.6.35 07 Jul 2026
CVE-2026-54011: Open WebUI Stored XSS Vulnerability in Mermaid Markdown Preview 8.7 high 0.9.6 17 Jun 2026
CVE-2026-45315: Open WebUI Stored XSS via Attacker-Controlled File Extension in Audio Transcriptions 8.7 high 0.9.3 14 May 2026
CVE-2026-44552: Open WebUI Redis Cache Keys Vulnerability Leading to Cross-Instance Cache Poisoning 8.7 high 0.9.0 08 May 2026
CVE-2026-54008: Open WebUI Redirect-Bypass SSRF Vulnerability in OAuth Process 8.5 high 0.9.6 13 Jul 2026
CVE-2026-45400: Open WebUI SSRF Bypass Vulnerability in URL Validation 8.5 high 0.9.5 13 Jul 2026
CVE-2026-45401: Open WebUI SSRF Bypass via HTTP Redirect Following 8.5 high 0.9.5 13 Jul 2026
CVE-2026-45331: Open WebUI SSRF Vulnerability in RAG Web Search Feature 8.5 high 0.9.0 13 Jul 2026
CVE-2025-65958: Open WebUI SSRF Vulnerability Allows Arbitrary URL Access 8.5 high 0.6.37 07 Jul 2026
CVE-2026-54008: Open WebUI Redirect-Bypass SSRF Vulnerability in OAuth Process 8.5 high 0.9.6 17 Jun 2026
CVE-2026-45401: Open WebUI SSRF Bypass via HTTP Redirect Following 8.5 high 0.9.5 14 May 2026
CVE-2026-45400: Open WebUI SSRF Bypass Vulnerability in URL Validation 8.5 high 0.9.5 14 May 2026
CVE-2026-45331: Open WebUI SSRF Vulnerability in RAG Web Search Feature 8.5 high 0.9.0 14 May 2026
CVE-2025-65958: Open WebUI SSRF Vulnerability Allows Arbitrary URL Access 8.5 high 0.6.37 04 Dec 2025
CVE-2024-7990: Open WebUI Stored XSS Vulnerability in open-webui Package 8.4 high No fix published 07 Jul 2026
CVE-2024-7990: Open WebUI Stored XSS Vulnerability in open-webui Package 8.4 high No fix published 20 Mar 2025
CVE-2026-54010: Open WebUI Cross-User File Read and Deletion Vulnerability 8.3 high 0.9.6 13 Jul 2026
CVE-2026-44570: Open WebUI Inconsistent Authorization Controls in Memories API 8.3 high 0.6.19 13 Jul 2026
CVE-2024-7039: Open WebUI Improper Privilege Management Allows Admin Deletion via API 8.3 high No fix published 07 Jul 2026
CVE-2026-54010: Open WebUI Arbitrary File Access and Deletion Vulnerability 8.3 high 0.9.6 17 Jun 2026
CVE-2026-44570: Open WebUI Inconsistent Authorization Controls in Memories API 8.3 high 0.6.19 11 May 2026
CVE-2024-7039: Open WebUI Admin Deletion Vulnerability via API Endpoint 8.3 high No fix published 20 Mar 2025
CVE-2026-45675: Open WebUI LDAP and OAuth First-User Race Condition Vulnerability 8.1 high 0.9.0 13 Jul 2026
CVE-2026-45402: Open WebUI Cross-User File Access Vulnerability 8.1 high 0.9.5 13 Jul 2026
CVE-2026-44565: Open WebUI Arbitrary File Write and Delete via Path Traversal Vulnerability 8.1 high 0.6.10 13 Jul 2026
CVE-2026-44554: Open WebUI Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite 8.1 high 0.9.0 13 Jul 2026
CVE-2026-44553: Open WebUI Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access 8.1 high 0.9.0 13 Jul 2026
CVE-2024-8060: Open WebUI Arbitrary File Upload Vulnerability Leading to Remote Code Execution 8.1 high 0.5.17 07 Jul 2026
CVE-2024-7043: Open WebUI Arbitrary File Reading and Deletion Vulnerability 8.1 high No fix published 07 Jul 2026
CVE-2026-45675: Open WebUI LDAP and OAuth First-User Race Condition Vulnerability 8.1 high 0.9.0 14 May 2026
CVE-2026-45402: Open WebUI Cross-User File Access Vulnerability 8.1 high 0.9.5 14 May 2026
CVE-2026-44565: Open WebUI Path Traversal Vulnerability Leading to Arbitrary File Write and Delete 8.1 high 0.6.10 11 May 2026
CVE-2026-44554: Open WebUI Knowledge Base Destruction and RAG Poisoning Vulnerability 8.1 high 0.9.0 08 May 2026
CVE-2026-44553: Open WebUI Socket.IO Session Vulnerability Allows Unauthorized Note Access 8.1 high 0.9.0 08 May 2026
CVE-2024-8060: Open WebUI Arbitrary File Upload Vulnerability Leading to Remote Code Execution 8.1 high 0.5.17 20 Mar 2025
CVE-2024-7043: Open WebUI Arbitrary File Reading and Deletion Vulnerability 8.1 high No fix published 20 Mar 2025
Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection) 8.0 high 0.10.0 04 Aug 2026
Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection) 8.0 high 0.10.0 24 Jul 2026
CVE-2026-45671: Open WebUI Unauthorized File Deletion Vulnerability 8.0 high 0.9.0 13 Jul 2026
CVE-2026-45671: Open WebUI Unauthorized File Deletion via Shared Chat Access Bypass 8.0 high 0.9.0 14 May 2026
CVE-2026-59216: Open WebUI Arbitrary Code Execution via Cross-User Session Hijacking 7.7 high 0.10.0 04 Aug 2026
CVE-2026-59216: Open WebUI Arbitrary Code Execution via Cross-User Session Hijacking 7.7 high 0.10.0 24 Jul 2026
CVE-2026-54018: Open WebUI SSRF Protection Bypass in Playwright Web Loader 7.7 high 0.9.6 13 Jul 2026
CVE-2026-54017: Open WebUI Path Traversal and SSRF Vulnerability in open-webui Package 7.7 high 0.9.6 13 Jul 2026
CVE-2026-45338: Open WebUI SSRF Vulnerability via OAuth Profile Picture URL 7.7 high 0.9.0 13 Jul 2026
CVE-2026-45303: Open WebUI Stored XSS via HTML Rendering View 7.7 high 0.6.5 13 Jul 2026
CVE-2026-34222: Open WebUI Tool Valves Access Control Vulnerability 7.7 high 0.8.11 13 Jul 2026
CVE-2024-7959: Open WebUI SSRF Vulnerability in open-webui Package 7.7 high No fix published 07 Jul 2026
CVE-2026-54018: Open WebUI SSRF Protection Bypass in Playwright Web Loader 7.7 high 0.9.6 17 Jun 2026
CVE-2026-54017: Open WebUI Path Traversal and SSRF Vulnerability in open-webui Package 7.7 high 0.9.6 17 Jun 2026
CVE-2026-45338: Open WebUI SSRF Vulnerability via OAuth Profile Picture URL 7.7 high 0.9.0 14 May 2026
CVE-2026-45303: Open WebUI Stored XSS Vulnerability via HTML Rendering View 7.7 high 0.6.5 14 May 2026
CVE-2026-34222: Open WebUI Tool Valves Access Control Vulnerability 7.7 high 0.8.11 01 Apr 2026
CVE-2024-7959: Open-WebUI SSRF Vulnerability in open-webui Package 7.7 high No fix published 20 Mar 2025
CVE-2026-54013: Open WebUI Stored XSS Vulnerability via Model Profile Images 7.6 high 0.9.6 13 Jul 2026
CVE-2026-44555: Open WebUI Model Chaining Bypass Vulnerability 7.6 high 0.9.0 13 Jul 2026
CVE-2024-7053: Open WebUI Session Fixation Vulnerability 7.6 high No fix published 07 Jul 2026
CVE-2026-54013: Open WebUI Stored XSS Vulnerability via Model Profile Images 7.6 high 0.9.6 17 Jun 2026
CVE-2026-44555: Open WebUI Model Chaining Bypasses Access Control 7.6 high 0.9.0 08 May 2026
CVE-2024-7053: Open WebUI Session Fixation Vulnerability 7.6 high No fix published 20 Mar 2025
CVE-2026-45398: Open WebUI IDOR Vulnerability Allows Unauthorized Access to Knowledge Bases 7.5 high 0.9.5 13 Jul 2026
CVE-2024-8053: Open WebUI PDF Endpoint Lacks Authentication Leading to Potential DoS 7.5 high No fix published 07 Jul 2026
CVE-2024-7983: Open WebUI Denial of Service via Unauthenticated Markdown Conversion 7.5 high No fix published 07 Jul 2026
CVE-2024-7036: Open-webui Uncontrolled Resource Consumption Vulnerability 7.5 high No fix published 07 Jul 2026
CVE-2024-12537: Open-webui Uncontrolled Resource Consumption Vulnerability 7.5 high No fix published 07 Jul 2026
CVE-2024-12534: Open-webui Uncontrolled Resource Consumption Vulnerability 7.5 high No fix published 07 Jul 2026
CVE-2026-45398: Open WebUI IDOR Vulnerability Allows Unauthorized Access to Knowledge Bases 7.5 high 0.9.5 14 May 2026
CVE-2024-7983: Open WebUI Denial of Service via Unauthenticated Markdown Conversion Endpoint 7.5 high No fix published 20 Mar 2025
CVE-2024-8053: Open WebUI PDF Endpoint Lacks Authentication Leading to Potential DoS 7.5 high No fix published 20 Mar 2025
CVE-2024-7999: Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability 7.5 high 0.4.7 20 Mar 2025
CVE-2024-7036: Open WebUI Uncontrolled Resource Consumption Vulnerability 7.5 high No fix published 20 Mar 2025
CVE-2024-12868: Open WebUI Vulnerable to Denial of Service via Starlette Dependency 7.5 high No fix published 20 Mar 2025
CVE-2024-12537: Open WebUI Uncontrolled Resource Consumption Vulnerability 7.5 high No fix published 20 Mar 2025
CVE-2024-12534: Open-webui Uncontrolled Resource Consumption Vulnerability 7.5 high No fix published 20 Mar 2025
CVE-2025-46719: Open WebUI Stored XSS Vulnerability Leading to Account Takeover and RCE 7.4 high 0.6.6 13 Jul 2026
CVE-2025-46719: Open WebUI Stored XSS Vulnerability Leading to Account Takeover and RCE 7.4 high 0.6.6 07 Jul 2026
CVE-2026-45314: Open WebUI XSS Vulnerability via SVG in Webhook Profile Image 7.4 high 0.9.3 14 May 2026
CVE-2026-59214: Open WebUI Stored Web Worker XSS Vulnerability Leading to Remote Code Execution 7.3 high 0.10.0 04 Aug 2026
CVE-2026-59214: Open WebUI Stored XSS via Pyodide Leading to Remote Code Execution 7.3 high 0.10.0 24 Jul 2026
CVE-2026-26193: Open WebUI Stored XSS Vulnerability via iFrame Embeds 7.3 high 0.6.44 13 Jul 2026
CVE-2026-26192: Open WebUI Stored XSS Vulnerability via iFrame in Citations Model 7.3 high 0.7.0 13 Jul 2026
CVE-2026-44549: Open WebUI Stored XSS Vulnerability in Excel File Preview 7.3 high 0.8.0 13 Jul 2026
CVE-2026-44721: open-webui Stored XSS Vulnerability via Model Description 7.3 high 0.9.0 13 Jul 2026
CVE-2026-26193: Open WebUI Stored XSS Vulnerability via iFrame Embeds in Response Messages 7.3 high 0.6.44 07 Jul 2026
CVE-2026-26192: Open WebUI Stored XSS Vulnerability via iFrame in Citations Model 7.3 high 0.7.0 07 Jul 2026
CVE-2025-64496: Open WebUI Code Injection Vulnerability via SSE Events 7.3 high 0.6.35 07 Jul 2026
Stored XSS Vulnerability in Open WebUI via OAuth Profile Image Handling 7.3 high 0.9.5 14 May 2026
CVE-2026-44549: Open WebUI Stored XSS Vulnerability in Excel File Preview 7.3 high 0.8.0 08 May 2026
CVE-2026-87999: Open WebUI Vulnerability Allows Authenticated Users to Access Internal Azure Platform Channel 7.1 high 0.11.1 01 Oct 2026
CVE-2026-87999: Open WebUI Vulnerability Allows Authenticated Users to Access Azure Platform Channel 7.1 high 0.11.1 10 Sep 2026
CVE-2026-54007: Open WebUI Cross-Origin postMessage Confirmation Bypass Vulnerability 7.1 high 0.9.6 13 Jul 2026
CVE-2026-54012: Open WebUI Cross-User File Read and Deletion Vulnerability 7.1 high 0.9.6 13 Jul 2026
CVE-2026-45399: Open WebUI Low-Privilege User Task Control Vulnerability 7.1 high 0.9.0 13 Jul 2026
CVE-2026-45350: Open WebUI Chat Completion API Tool Restriction Bypass Vulnerability 7.1 high 0.8.6 13 Jul 2026
CVE-2026-45349: Open WebUI Broken Access Control in Completions API 7.1 high 0.9.0 13 Jul 2026
CVE-2026-44569: Open WebUI IDOR Vulnerability Allows Unauthorized Message Modification and Deletion 7.1 high 0.6.19 13 Jul 2026
CVE-2026-44556: Open-WebUI Model Access Control Bypass Vulnerability 7.1 high 0.9.0 13 Jul 2026
CVE-2026-28788: Open WebUI File Overwrite Vulnerability Due to Missing Ownership Check 7.1 high 0.8.6 13 Jul 2026
CVE-2026-54012: Open WebUI Cross-User File Read and Deletion Vulnerability 7.1 high 0.9.6 17 Jun 2026
CVE-2026-54007: Open WebUI Cross-origin postMessage Confirmation Bypass Vulnerability 7.1 high 0.9.6 17 Jun 2026
CVE-2026-45399: Open WebUI Task Management Vulnerability Allows Low-Privilege Users to Disrupt System Operations 7.1 high 0.9.0 14 May 2026
CVE-2026-45350: Open WebUI Chat Completion API Tool Restriction Bypass Vulnerability 7.1 high 0.8.6 14 May 2026
CVE-2026-45349: Open WebUI Broken Access Control in Completions API 7.1 high 0.9.0 14 May 2026
CVE-2026-44569: Open WebUI Insecure Message Access Allows Unauthorized Message Modification and Deletion 7.1 high 0.6.19 11 May 2026
CVE-2026-44556: Open-WebUI Access Control Bypass in Responses Endpoint 7.1 high 0.9.0 08 May 2026
CVE-2026-28788: Open WebUI File Overwrite Vulnerability Due to Missing Ownership Check 7.1 high 0.8.6 27 Mar 2026
CVE-2024-7035: Open-webui Vulnerable to Cross-Site Request Forgery (CSRF) 6.9 medium No fix published 07 Jul 2026
Cross-Site Request Forgery (CSRF) Vulnerability in Open WebUI (v0.3.8) 6.9 medium No fix published 20 Mar 2025
CVE-2024-7044: Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload 6.8 medium No fix published 07 Jul 2026
CVE-2024-7044: Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload 6.8 medium No fix published 20 Mar 2025
CVE-2026-70491: Open WebUI Tool Source Code Disclosure to Read-Only Users 6.5 medium 0.11.0 10 Aug 2026
CVE-2026-70491: Open WebUI Tool Source Code Disclosure to Read-Only Users 6.5 medium 0.11.0 04 Aug 2026
CVE-2026-45339: Open WebUI API Key Endpoint Restriction Bypass Vulnerability 6.5 medium 0.9.0 23 Jul 2026
CVE-2026-54019: Open WebUI RAG ACL Bypass Vulnerability in open-webui Package 6.5 medium 0.9.6 13 Jul 2026
CVE-2026-54009: Open WebUI Cross-User File Disclosure Vulnerability 6.5 medium 0.9.6 13 Jul 2026
CVE-2026-45351: Open WebUI System Prompt Leakage Vulnerability 6.5 medium 0.8.9 13 Jul 2026
CVE-2026-45667: Open WebUI Unauthenticated Endpoint Allows Costly Embedding Generation 6.5 medium 0.8.0 13 Jul 2026
CVE-2026-45666: Open WebUI Indirect Object Reference (IDOR) Vulnerability in User Notes 6.5 medium 0.8.11 13 Jul 2026
CVE-2026-45345: Open WebUI Privilege Escalation via Unauthorized Model Update 6.5 medium 0.5.7 13 Jul 2026
CVE-2026-44571: Open WebUI Improper Authorization in Standard Channels Allows Unauthorized Message Updates 6.5 medium 0.8.6 13 Jul 2026
CVE-2026-44560: Open WebUI Unauthorized File and Knowledge Base Content Access via RAG Vector Search 6.5 medium 0.9.0 13 Jul 2026
CVE-2026-44562: Open WebUI Model Import Vulnerability Allows Unauthorized Model Overwrites 6.5 medium 0.9.0 13 Jul 2026
CVE-2024-7033: Open WebUI Arbitrary File Write Vulnerability 6.5 medium No fix published 07 Jul 2026
CVE-2024-7034: Open WebUI Arbitrary File Write Vulnerability 6.5 medium No fix published 07 Jul 2026
CVE-2024-7037: open-webui Arbitrary File Write and Delete Vulnerability 6.5 medium No fix published 07 Jul 2026
CVE-2024-7041: open-webui Insecure Direct Object Reference (IDOR) Vulnerability 6.5 medium No fix published 07 Jul 2026
CVE-2026-54019: Open WebUI RAG ACL Bypass Vulnerability in Milvus Multitenancy Mode 6.5 medium 0.9.6 17 Jun 2026
CVE-2026-54009: Open WebUI Cross-User File Disclosure Vulnerability 6.5 medium 0.9.6 17 Jun 2026
CVE-2026-45667: Open WebUI Unauthenticated Endpoint Allows Costly Embedding Generation 6.5 medium 0.8.0 14 May 2026
CVE-2026-45666: Open WebUI Indirect Object Reference (IDOR) Vulnerability in User Notes 6.5 medium 0.8.11 14 May 2026
CVE-2026-45351: Open WebUI Exposes System Prompt to Regular User 6.5 medium 0.8.9 14 May 2026
CVE-2026-45345: Open WebUI Authorization Bypass in Model Update Function 6.5 medium 0.5.7 14 May 2026
CVE-2026-44571: Open WebUI Improper Authorization Vulnerability in Standard Channels 6.5 medium 0.8.6 11 May 2026
CVE-2026-44560: Open WebUI Unauthorized File and Knowledge Base Content Access via RAG Vector Search 6.5 medium 0.9.0 08 May 2026
CVE-2026-44562: Open WebUI Model Import Vulnerability Allows Unauthorized Model Overwrites 6.5 medium 0.9.0 08 May 2026
CVE-2024-7033: Open-WebUI Arbitrary File Write Vulnerability 6.5 medium No fix published 20 Mar 2025
CVE-2024-7034: Open WebUI Arbitrary File Write Vulnerability 6.5 medium No fix published 20 Mar 2025
CVE-2024-7037: open-webui Arbitrary File Write and Delete Vulnerability 6.5 medium No fix published 09 Oct 2024
CVE-2024-7041: open-webui Insecure Direct Object Reference (IDOR) Vulnerability 6.5 medium No fix published 09 Oct 2024
CVE-2025-46571: Open WebUI Stored XSS via Uploaded HTML Files 6.4 medium 0.6.6 13 Jul 2026
CVE-2026-54015: Open WebUI Prompt History IDOR Vulnerability Allows Unauthorized Access and Deletion 6.4 medium 0.9.6 13 Jul 2026
CVE-2025-46571: Open WebUI Allows Limited Stored XSS via Uploaded HTML File 6.4 medium 0.6.6 07 Jul 2026
CVE-2026-54015: Open WebUI Prompt History IDOR Vulnerability Allows Unauthorized Access and Deletion 6.4 medium 0.9.6 17 Jun 2026
CVE-2026-54020: Open WebUI DNS Rebinding SSRF Bypass Vulnerability 6.3 medium 0.11.0 10 Aug 2026
CVE-2026-54020: Open WebUI DNS Rebinding SSRF Bypass Vulnerability 6.3 medium 0.11.0 04 Aug 2026
CVE-2026-54021: Open WebUI Vulnerability in open-webui Allows Authenticated Users to Access Unauthorized Ollama Backends 6.3 medium 0.9.6 13 Jul 2026
CVE-2026-54021: Open WebUI Vulnerability in open-webui Allows Unauthorized Access to Ollama Backends 6.3 medium 0.9.6 17 Jun 2026
CVE-2026-45314: Open WebUI XSS Vulnerability via SVG in Webhook Profile Image 6.1 medium 0.9.3 13 Jul 2026
CVE-2024-6706: Open WebUI Stored Cross-Site Scripting Vulnerability 6.1 medium No fix published 07 Jul 2026
CVE-2024-6706: Open WebUI Stored Cross-Site Scripting Vulnerability 6.1 medium No fix published 08 Aug 2024
CVE-2026-45396: Open WebUI Feedback Form Mass Assignment Vulnerability 5.4 medium 0.9.5 13 Jul 2026
CVE-2026-45365: Open WebUI Bypass Vulnerability Allows Unauthorized Model Access 5.4 medium 0.8.11 13 Jul 2026
CVE-2026-45318: Open WebUI Stored XSS via Unsanitized Office File Previews 5.4 medium 0.9.3 13 Jul 2026
CVE-2026-45299: Open WebUI Stored Cross-Site Scripting Vulnerability in Profile Picture Handling 5.4 medium 0.8.0 13 Jul 2026
CVE-2026-44558: Open WebUI Channel Access Grants Bypass Vulnerability 5.4 medium 0.9.0 13 Jul 2026
CVE-2026-44561: Open WebUI Vulnerability Allows Deactivated Users to Access Group/DM Channels 5.4 medium 0.9.0 13 Jul 2026
CVE-2026-44563: Open WebUI's Ollama Model Access Control Bypass Vulnerability 5.4 medium 0.9.0 13 Jul 2026
CVE-2026-44564: Open WebUI Read-Only Users Can Modify Collaborative Documents via Socket.IO 5.4 medium 0.9.0 13 Jul 2026
CVE-2026-29070: Open WebUI Arbitrary File Deletion Vulnerability 5.4 medium 0.8.6 13 Jul 2026
CVE-2026-45396: Open WebUI Feedback Form Mass Assignment Vulnerability 5.4 medium 0.9.5 14 May 2026
CVE-2026-45365: Open WebUI Authenticated User Access Control Bypass Vulnerability 5.4 medium 0.8.11 14 May 2026
CVE-2026-45318: Open WebUI Stored XSS via Unsanitized Office File Previews 5.4 medium 0.9.3 14 May 2026
CVE-2026-45299: Open WebUI Stored Cross-Site Scripting Vulnerability in Profile Picture Handling 5.4 medium 0.8.0 14 May 2026
CVE-2026-44561: Open WebUI Vulnerability Allows Deactivated Users to Access Group/DM Channels 5.4 medium 0.9.0 08 May 2026
CVE-2026-44564: Open WebUI Allows Read-Only Users to Modify Collaborative Documents via Socket.IO 5.4 medium 0.9.0 08 May 2026
CVE-2026-44563: Open WebUI's Ollama Model Access Control Bypass Vulnerability 5.4 medium 0.9.0 08 May 2026
CVE-2026-44558: Open WebUI Channel Access Grants Bypass Vulnerability 5.4 medium 0.9.0 08 May 2026
CVE-2026-29070: Open WebUI Arbitrary File Deletion Vulnerability 5.4 medium 0.8.6 27 Mar 2026
CVE-2026-59218: Open WebUI Account Enumeration via Login Timing Discrepancy 5.3 medium 0.10.0 04 Aug 2026
CVE-2026-59218: Open WebUI Account Enumeration via Timing Discrepancy 5.3 medium 0.10.0 24 Jul 2026
CVE-2026-54022: Open WebUI Allows Unauthorized Access to Private Notes via Socket.IO 5.3 medium 0.8.11 13 Jul 2026
CVE-2026-45397: Open WebUI Unauthenticated RAG Configuration Disclosure Vulnerability 5.3 medium 0.9.5 13 Jul 2026
CVE-2026-54022: Open WebUI Socket.IO Vulnerability Allows Unauthorized Access to Private Notes 5.3 medium 0.8.11 17 Jun 2026
CVE-2026-45397: Open WebUI Unauthenticated RAG Configuration Disclosure Vulnerability 5.3 medium 0.9.5 14 May 2026
CVE-2026-0767: Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability 5.3 medium No fix published 23 Jan 2026
CVE-2026-44550: Open WebUI Mass Assignment Vulnerability Allows Unauthorized Folder Creation 5.0 medium 0.9.0 13 Jul 2026
CVE-2026-44550: Open WebUI Mass Assignment Vulnerability Allows Unauthorized Folder Creation 5.0 medium 0.9.0 08 May 2026
CVE-2024-7040: Open WebUI Improper Access Control Vulnerability 4.9 medium No fix published 20 Mar 2025
CVE-2026-44568: Open WebUI Stored XSS Vulnerability in Pending User Overlay 4.8 medium 0.9.0 13 Jul 2026
CVE-2026-44568: Open WebUI Stored XSS Vulnerability in Pending User Overlay 4.8 medium 0.9.0 08 May 2026
CVE-2026-45317: Open-WebUI Cross-Site Request Forgery (CSRF) Vulnerability via Image URL Manipulation 4.6 medium 0.9.3 13 Jul 2026
CVE-2026-45317: Open-WebUI Cross-Site Request Forgery Vulnerability via Image URL Manipulation 4.6 medium 0.9.3 14 May 2026
CVE-2026-59223: Open WebUI Vulnerability in open-webui Allows Bypass of Host Allow/Block Filters 4.3 medium 0.10.0 04 Aug 2026
CVE-2026-59217: Open WebUI Arbitrary File Upload Bypass for Read-Only Users 4.3 medium 0.10.0 04 Aug 2026
CVE-2026-59223: Open WebUI Bypass Vulnerability in Host Allow/Block Filter 4.3 medium 0.10.0 24 Jul 2026
CVE-2026-59217: Open WebUI Arbitrary File Upload Bypass for Read-Only Users 4.3 medium 0.10.0 24 Jul 2026
CVE-2026-34225: Open WebUI Blind Server Side Request Forgery in Image Edit Functionality 4.3 medium No fix published 13 Jul 2026
CVE-2026-54016: Open WebUI BOLA Vulnerability Allows Unauthorized Knowledge Base File Enumeration 4.3 medium 0.9.6 13 Jul 2026
CVE-2026-54014: Open WebUI Path Traversal Vulnerability in Cache File Serving 4.3 medium 0.9.6 13 Jul 2026
CVE-2026-54006: Open WebUI Calendar Event IDOR Vulnerability 4.3 medium 0.9.6 13 Jul 2026
CVE-2026-45386: Open WebUI IDOR Vulnerability in pin_channel_message API Endpoint 4.3 medium 0.9.5 13 Jul 2026
CVE-2026-45387: Open WebUI Model Permission Misconfiguration Leading to System Prompt Leakage 4.3 medium 0.9.5 13 Jul 2026
CVE-2026-45385: Open WebUI IDOR Vulnerability in Message Update API 4.3 medium 0.9.5 13 Jul 2026
CVE-2026-45347: Open WebUI Blind SSRF Vulnerability in PDF Generation 4.3 medium 0.5.11 13 Jul 2026
CVE-2026-44557: Open WebUI Knowledge Base Enumeration Vulnerability 4.3 medium 0.9.0 13 Jul 2026
CVE-2026-44559: Open WebUI Exposes Private Channel Membership Information Due to Missing Access Check 4.3 medium 0.9.0 13 Jul 2026
CVE-2026-28786: Open WebUI Path Traversal Vulnerability in Audio Transcriptions Endpoint 4.3 medium 0.8.6 13 Jul 2026
CVE-2026-34225: Open WebUI Blind Server Side Request Forgery in Image Edit Functionality 4.3 medium No fix published 07 Jul 2026
CVE-2024-7045: Open WebUI Arbitrary Prompt Read Due to Improper Access Control 4.3 medium No fix published 07 Jul 2026
CVE-2024-7046: Open WebUI Admin Details Exposure Vulnerability 4.3 medium No fix published 07 Jul 2026
CVE-2026-54016: Open WebUI Unauthorized Knowledge Base File Enumeration Vulnerability 4.3 medium 0.9.6 17 Jun 2026
CVE-2026-54014: Open WebUI Sibling-Prefix Path Traversal Vulnerability 4.3 medium 0.9.6 17 Jun 2026
CVE-2026-54006: Open WebUI IDOR Vulnerability Allows Unauthorized Calendar Event Re-parenting 4.3 medium 0.9.6 17 Jun 2026
CVE-2026-45387: Open WebUI Model Permission Misconfiguration Leading to System Prompt Leakage 4.3 medium 0.9.5 14 May 2026
CVE-2026-45386: Open WebUI IDOR Vulnerability in pin_channel_message API Endpoint 4.3 medium 0.9.5 14 May 2026
CVE-2026-45385: Open WebUI IDOR Vulnerability in Message Update API 4.3 medium 0.9.5 14 May 2026
CVE-2026-45347: Open WebUI Vulnerable to Blind SSRF via PDF Generate Function 4.3 medium 0.5.11 14 May 2026
CVE-2026-44559: Open WebUI Exposes Private Channel Membership Information Due to Missing Access Check 4.3 medium 0.9.0 08 May 2026
CVE-2026-44557: Open WebUI Knowledge Base Enumeration Vulnerability 4.3 medium 0.9.0 08 May 2026
CVE-2026-28786: Open WebUI Path Traversal Vulnerability in Audio Transcription Endpoint 4.3 medium 0.8.6 27 Mar 2026
CVE-2024-7045: Open WebUI Arbitrary Prompt Read Due to Improper Access Control 4.3 medium No fix published 20 Mar 2025
Improper Access Control in Open WebUI: Admin Details Exposure 4.3 medium No fix published 20 Mar 2025
CVE-2025-15603: Open WebUI JWT Key Handler Insufficient Randomness Vulnerability 3.7 low No fix published 09 Mar 2026
CVE-2026-45316: Open WebUI Allows Read-Only Users to Toggle Note Pin Status via Incorrect Permission Check 3.5 low 0.9.3 13 Jul 2026
CVE-2026-45316: Open WebUI Allows Read-Only Users to Toggle Note Pin Status via Incorrect Permission Check 3.5 low 0.9.3 14 May 2026
CVE-2026-59215: Open WebUI Private Channel Message Disclosure Vulnerability 3.1 low 0.10.0 04 Aug 2026
CVE-2026-59215: Open WebUI Private Channel Message Disclosure Vulnerability 3.1 low 0.10.0 24 Jul 2026
CVE-2026-29071: Open WebUI Insecure Direct Object Reference (IDOR) Vulnerability 3.1 low 0.8.6 13 Jul 2026
CVE-2026-29071: Open WebUI Insecure Direct Object Reference (IDOR) Vulnerability Allows Unauthorized Access to User Memories 3.1 low 0.8.6 27 Mar 2026
CVE-2024-7038: open-webui File Enumeration and Directory Traversal Vulnerability 2.7 low No fix published 07 Jul 2026
CVE-2024-7038: open-webui Information Disclosure via File Enumeration and Directory Traversal 2.7 low No fix published 09 Oct 2024
CVE-2025-63681: open-webui Vulnerable to Incorrect Access Control 2.1 low No fix published 07 Jul 2026
CVE-2025-63681: open-webui Vulnerable to Incorrect Access Control 2.1 low No fix published 04 Dec 2025

Looking for another version, or everything Vulert holds for open-webui?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About open-webui 0.4.1

Is open-webui 0.4.1 vulnerable?

Yes. 230 vulnerabilities in the Vulert database cover open-webui 0.4.1: 2 critical, 111 high, 106 medium and 11 low. The upgrade Vulert recommends is 0.12.3, and each entry above names the fixed version to move to.

Which version of open-webui should I use instead of 0.4.1?

0.12.3 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 0.4.1 the latest release of open-webui?

No. 0.4.1 was published 20 Nov 2024, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor open-webui for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the open-webui version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.