VulertSecurity VulertSecurity

Vulnerability Database · PyPI · open-webui · Version

open-webui 0.9.0

0.9.0 is affected by 177 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 0.12.3.

Critical 0 High 71 Medium 91 Low 15 Unrated 0

All open-webui versions & vulnerabilities → Search the database for this package →
Released 21 Apr 2026 Licence non-standard Also known from other sources 129 Newer releases 170 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

open-webui 0.9.0 vulnerabilities

177 vulnerabilities cover open-webui 0.9.0. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-87995: Open WebUI Account Takeover via Same-Origin XSS in Terminal Port Preview 8.7 high 0.11.1 01 Oct 2026
CVE-2026-87995: Open WebUI Account Takeover via Same-Origin XSS in Terminal Port Preview 8.7 high 0.11.1 10 Sep 2026
CVE-2026-54011: Open WebUI Stored XSS Vulnerability in Mermaid Markdown Preview 8.7 high 0.9.6 13 Jul 2026
CVE-2026-45315: Open WebUI Stored XSS via Attacker-Controlled File Extension in Audio Transcriptions 8.7 high 0.9.3 13 Jul 2026
CVE-2026-54011: Open WebUI Stored XSS Vulnerability in Mermaid Markdown Preview 8.7 high 0.9.6 17 Jun 2026
CVE-2026-45315: Open WebUI Stored XSS via Attacker-Controlled File Extension in Audio Transcriptions 8.7 high 0.9.3 14 May 2026
CVE-2026-54008: Open WebUI Redirect-Bypass SSRF Vulnerability in OAuth Process 8.5 high 0.9.6 13 Jul 2026
CVE-2026-45400: Open WebUI SSRF Bypass Vulnerability in URL Validation 8.5 high 0.9.5 13 Jul 2026
CVE-2026-45401: Open WebUI SSRF Bypass via HTTP Redirect Following 8.5 high 0.9.5 13 Jul 2026
CVE-2026-54008: Open WebUI Redirect-Bypass SSRF Vulnerability in OAuth Process 8.5 high 0.9.6 17 Jun 2026
CVE-2026-45401: Open WebUI SSRF Bypass via HTTP Redirect Following 8.5 high 0.9.5 14 May 2026
CVE-2026-45400: Open WebUI SSRF Bypass Vulnerability in URL Validation 8.5 high 0.9.5 14 May 2026
CVE-2024-7990: Open WebUI Stored XSS Vulnerability in open-webui Package 8.4 high No fix published 07 Jul 2026
CVE-2024-7990: Open WebUI Stored XSS Vulnerability in open-webui Package 8.4 high No fix published 20 Mar 2025
CVE-2026-54010: Open WebUI Cross-User File Read and Deletion Vulnerability 8.3 high 0.9.6 13 Jul 2026
CVE-2024-7039: Open WebUI Improper Privilege Management Allows Admin Deletion via API 8.3 high No fix published 07 Jul 2026
CVE-2026-54010: Open WebUI Arbitrary File Access and Deletion Vulnerability 8.3 high 0.9.6 17 Jun 2026
CVE-2024-7039: Open WebUI Admin Deletion Vulnerability via API Endpoint 8.3 high No fix published 20 Mar 2025
CVE-2026-70486: Open WebUI Account Takeover via Same-Origin XSS in Terminal File Preview 8.2 high 0.11.0 10 Aug 2026
CVE-2026-70486: Open WebUI XSS Vulnerability Leading to Account Takeover 8.2 high 0.11.0 04 Aug 2026
CVE-2026-87016: Open WebUI SQLite Vulnerability Allows Unauthorized Sign-in via Wildcard Characters 8.1 high 0.11.1 01 Oct 2026
CVE-2026-87016: Open WebUI SQLite Vulnerability Allows Unauthorized Sign-in via Wildcard Characters 8.1 high 0.11.1 10 Sep 2026
CVE-2026-70482: Open WebUI Account Takeover via OAuth Token Exchange Vulnerability 8.1 high 0.11.0 10 Aug 2026
CVE-2026-70482: Open WebUI Account Takeover via OAuth Token Exchange Vulnerability 8.1 high 0.11.0 04 Aug 2026
CVE-2026-45402: Open WebUI Cross-User File Access Vulnerability 8.1 high 0.9.5 13 Jul 2026
CVE-2024-7043: Open WebUI Arbitrary File Reading and Deletion Vulnerability 8.1 high No fix published 07 Jul 2026
CVE-2026-45402: Open WebUI Cross-User File Access Vulnerability 8.1 high 0.9.5 14 May 2026
CVE-2024-7043: Open WebUI Arbitrary File Reading and Deletion Vulnerability 8.1 high No fix published 20 Mar 2025
Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection) 8.0 high 0.10.0 04 Aug 2026
Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection) 8.0 high 0.10.0 24 Jul 2026
CVE-2026-59216: Open WebUI Arbitrary Code Execution via Cross-User Session Hijacking 7.7 high 0.10.0 04 Aug 2026
CVE-2026-59216: Open WebUI Arbitrary Code Execution via Cross-User Session Hijacking 7.7 high 0.10.0 24 Jul 2026
CVE-2026-54018: Open WebUI SSRF Protection Bypass in Playwright Web Loader 7.7 high 0.9.6 13 Jul 2026
CVE-2026-54017: Open WebUI Path Traversal and SSRF Vulnerability in open-webui Package 7.7 high 0.9.6 13 Jul 2026
CVE-2024-7959: Open WebUI SSRF Vulnerability in open-webui Package 7.7 high No fix published 07 Jul 2026
CVE-2026-54018: Open WebUI SSRF Protection Bypass in Playwright Web Loader 7.7 high 0.9.6 17 Jun 2026
CVE-2026-54017: Open WebUI Path Traversal and SSRF Vulnerability in open-webui Package 7.7 high 0.9.6 17 Jun 2026
CVE-2024-7959: Open-WebUI SSRF Vulnerability in open-webui Package 7.7 high No fix published 20 Mar 2025
CVE-2026-54013: Open WebUI Stored XSS Vulnerability via Model Profile Images 7.6 high 0.9.6 13 Jul 2026
CVE-2024-7053: Open WebUI Session Fixation Vulnerability 7.6 high No fix published 07 Jul 2026
CVE-2026-54013: Open WebUI Stored XSS Vulnerability via Model Profile Images 7.6 high 0.9.6 17 Jun 2026
CVE-2024-7053: Open WebUI Session Fixation Vulnerability 7.6 high No fix published 20 Mar 2025
CVE-2026-87011: Open WebUI Unauthenticated Requests Can Stall Server via Uncached OIDC Fetches 7.5 high 0.11.1 01 Oct 2026
CVE-2026-87011: Open WebUI Unauthenticated Requests Can Stall Server via Uncached OIDC Fetches 7.5 high 0.11.1 10 Sep 2026
CVE-2026-45398: Open WebUI IDOR Vulnerability Allows Unauthorized Access to Knowledge Bases 7.5 high 0.9.5 13 Jul 2026
CVE-2024-8053: Open WebUI PDF Endpoint Lacks Authentication Leading to Potential DoS 7.5 high No fix published 07 Jul 2026
CVE-2024-7983: Open WebUI Denial of Service via Unauthenticated Markdown Conversion 7.5 high No fix published 07 Jul 2026
CVE-2024-7036: Open-webui Uncontrolled Resource Consumption Vulnerability 7.5 high No fix published 07 Jul 2026
CVE-2024-12537: Open-webui Uncontrolled Resource Consumption Vulnerability 7.5 high No fix published 07 Jul 2026
CVE-2024-12534: Open-webui Uncontrolled Resource Consumption Vulnerability 7.5 high No fix published 07 Jul 2026
CVE-2026-45398: Open WebUI IDOR Vulnerability Allows Unauthorized Access to Knowledge Bases 7.5 high 0.9.5 14 May 2026
CVE-2024-7983: Open WebUI Denial of Service via Unauthenticated Markdown Conversion Endpoint 7.5 high No fix published 20 Mar 2025
CVE-2024-8053: Open WebUI PDF Endpoint Lacks Authentication Leading to Potential DoS 7.5 high No fix published 20 Mar 2025
CVE-2024-7036: Open WebUI Uncontrolled Resource Consumption Vulnerability 7.5 high No fix published 20 Mar 2025
CVE-2024-12868: Open WebUI Vulnerable to Denial of Service via Starlette Dependency 7.5 high No fix published 20 Mar 2025
CVE-2024-12537: Open WebUI Uncontrolled Resource Consumption Vulnerability 7.5 high No fix published 20 Mar 2025
CVE-2024-12534: Open-webui Uncontrolled Resource Consumption Vulnerability 7.5 high No fix published 20 Mar 2025
CVE-2026-45314: Open WebUI XSS Vulnerability via SVG in Webhook Profile Image 7.4 high 0.9.3 14 May 2026
CVE-2026-59214: Open WebUI Stored Web Worker XSS Vulnerability Leading to Remote Code Execution 7.3 high 0.10.0 04 Aug 2026
CVE-2026-59214: Open WebUI Stored XSS via Pyodide Leading to Remote Code Execution 7.3 high 0.10.0 24 Jul 2026
Stored XSS Vulnerability in Open WebUI via OAuth Profile Image Handling 7.3 high 0.9.5 14 May 2026
CVE-2026-87999: Open WebUI Vulnerability Allows Authenticated Users to Access Internal Azure Platform Channel 7.1 high 0.11.1 01 Oct 2026
CVE-2026-87999: Open WebUI Vulnerability Allows Authenticated Users to Access Azure Platform Channel 7.1 high 0.11.1 10 Sep 2026
CVE-2026-70485: Open WebUI Vulnerability Allows Authenticated Users to Access Internal Services via NAT64-Encoded URLs 7.1 high 0.11.0 10 Aug 2026
CVE-2026-70485: Open WebUI Vulnerability Allows Access to Internal Services via NAT64 Encoded URLs 7.1 high 0.11.0 04 Aug 2026
CVE-2026-59219: Open WebUI JWT Revocation Bypass in Realtime Endpoints 7.1 high 0.10.0 04 Aug 2026
CVE-2026-59219: Open WebUI JWT Revocation Bypass in Realtime Endpoints 7.1 high 0.10.0 24 Jul 2026
CVE-2026-54007: Open WebUI Cross-Origin postMessage Confirmation Bypass Vulnerability 7.1 high 0.9.6 13 Jul 2026
CVE-2026-54012: Open WebUI Cross-User File Read and Deletion Vulnerability 7.1 high 0.9.6 13 Jul 2026
CVE-2026-54012: Open WebUI Cross-User File Read and Deletion Vulnerability 7.1 high 0.9.6 17 Jun 2026
CVE-2026-54007: Open WebUI Cross-origin postMessage Confirmation Bypass Vulnerability 7.1 high 0.9.6 17 Jun 2026
CVE-2024-7035: Open-webui Vulnerable to Cross-Site Request Forgery (CSRF) 6.9 medium No fix published 07 Jul 2026
Cross-Site Request Forgery (CSRF) Vulnerability in Open WebUI (v0.3.8) 6.9 medium No fix published 20 Mar 2025
CVE-2026-87015: Open WebUI Session Cookie Leakage in open-webui 6.8 medium 0.11.1 01 Oct 2026
CVE-2026-87015: Open WebUI Session Cookie Leakage in open-webui 6.8 medium 0.11.1 10 Sep 2026
CVE-2024-7044: Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload 6.8 medium No fix published 07 Jul 2026
CVE-2024-7044: Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload 6.8 medium No fix published 20 Mar 2025
CVE-2026-87014: Open WebUI Admin Role Demotion Vulnerability Allows Unauthorized Access to User Notes 6.5 medium 0.11.1 01 Oct 2026
CVE-2026-88006: Open WebUI Token Exchange Bypass Vulnerability 6.5 medium 0.11.1 01 Oct 2026
CVE-2026-88006: Open WebUI OAuth Token Exchange Bypass Vulnerability 6.5 medium 0.11.1 10 Sep 2026
CVE-2026-87014: Open WebUI Admin Role Sync Vulnerability Allows Unauthorized Access to User Notes 6.5 medium 0.11.1 10 Sep 2026
CVE-2026-88002: Open WebUI Server Hang via Cyclic Chat Message History 6.5 medium 0.11.1 10 Sep 2026
CVE-2026-88002: Open WebUI Server Hang via Cyclic Chat Message History 6.5 medium 0.11.1 09 Sep 2026
CVE-2026-70491: Open WebUI Tool Source Code Disclosure to Read-Only Users 6.5 medium 0.11.0 10 Aug 2026
CVE-2026-70489: Open WebUI Automation Recurrence Parsing Stall Vulnerability 6.5 medium 0.11.0 10 Aug 2026
CVE-2026-70491: Open WebUI Tool Source Code Disclosure to Read-Only Users 6.5 medium 0.11.0 04 Aug 2026
CVE-2026-70489: Open WebUI Automation Recurrence Parsing Stall Vulnerability 6.5 medium 0.11.0 04 Aug 2026
CVE-2026-54019: Open WebUI RAG ACL Bypass Vulnerability in open-webui Package 6.5 medium 0.9.6 13 Jul 2026
CVE-2026-54009: Open WebUI Cross-User File Disclosure Vulnerability 6.5 medium 0.9.6 13 Jul 2026
CVE-2024-7033: Open WebUI Arbitrary File Write Vulnerability 6.5 medium No fix published 07 Jul 2026
CVE-2024-7034: Open WebUI Arbitrary File Write Vulnerability 6.5 medium No fix published 07 Jul 2026
CVE-2024-7037: open-webui Arbitrary File Write and Delete Vulnerability 6.5 medium No fix published 07 Jul 2026
CVE-2024-7041: open-webui Insecure Direct Object Reference (IDOR) Vulnerability 6.5 medium No fix published 07 Jul 2026
CVE-2026-54019: Open WebUI RAG ACL Bypass Vulnerability in Milvus Multitenancy Mode 6.5 medium 0.9.6 17 Jun 2026
CVE-2026-54009: Open WebUI Cross-User File Disclosure Vulnerability 6.5 medium 0.9.6 17 Jun 2026
CVE-2024-7033: Open-WebUI Arbitrary File Write Vulnerability 6.5 medium No fix published 20 Mar 2025
CVE-2024-7034: Open WebUI Arbitrary File Write Vulnerability 6.5 medium No fix published 20 Mar 2025
CVE-2024-7037: open-webui Arbitrary File Write and Delete Vulnerability 6.5 medium No fix published 09 Oct 2024
CVE-2024-7041: open-webui Insecure Direct Object Reference (IDOR) Vulnerability 6.5 medium No fix published 09 Oct 2024
CVE-2026-54015: Open WebUI Prompt History IDOR Vulnerability Allows Unauthorized Access and Deletion 6.4 medium 0.9.6 13 Jul 2026
CVE-2026-54015: Open WebUI Prompt History IDOR Vulnerability Allows Unauthorized Access and Deletion 6.4 medium 0.9.6 17 Jun 2026
CVE-2026-70490: Open WebUI Terminal Access Bypass for Unapproved Accounts 6.3 medium 0.11.0 10 Aug 2026
CVE-2026-54020: Open WebUI DNS Rebinding SSRF Bypass Vulnerability 6.3 medium 0.11.0 10 Aug 2026
CVE-2026-70490: Open WebUI Terminal Access Bypass for Pending Accounts 6.3 medium 0.11.0 04 Aug 2026
CVE-2026-54020: Open WebUI DNS Rebinding SSRF Bypass Vulnerability 6.3 medium 0.11.0 04 Aug 2026
CVE-2026-54021: Open WebUI Vulnerability in open-webui Allows Authenticated Users to Access Unauthorized Ollama Backends 6.3 medium 0.9.6 13 Jul 2026
CVE-2026-54021: Open WebUI Vulnerability in open-webui Allows Unauthorized Access to Ollama Backends 6.3 medium 0.9.6 17 Jun 2026
CVE-2026-45314: Open WebUI XSS Vulnerability via SVG in Webhook Profile Image 6.1 medium 0.9.3 13 Jul 2026
CVE-2024-6706: Open WebUI Stored Cross-Site Scripting Vulnerability 6.1 medium No fix published 07 Jul 2026
CVE-2024-6706: Open WebUI Stored Cross-Site Scripting Vulnerability 6.1 medium No fix published 08 Aug 2024
CVE-2026-59222: Open WebUI Exposes Sensitive User Credentials via Channel Members Endpoint 6.0 medium 0.10.0 04 Aug 2026
CVE-2026-59222: Open WebUI Exposes Sensitive User Credentials via Channel Members Endpoint 6.0 medium 0.10.0 24 Jul 2026
CVE-2026-70481: Open WebUI Allows Message Manipulation by Any User with Write Access 5.4 medium 0.11.0 10 Aug 2026
CVE-2026-70481: Open WebUI Allows Message Manipulation by Any User with Write Access 5.4 medium 0.11.0 04 Aug 2026
CVE-2026-59225: Open WebUI Task Endpoint Access Control Bypass Vulnerability 5.4 medium 0.10.0 04 Aug 2026
CVE-2026-59225: Open WebUI Arena Task Endpoints Bypass Model Access Controls 5.4 medium 0.10.0 24 Jul 2026
CVE-2026-45396: Open WebUI Feedback Form Mass Assignment Vulnerability 5.4 medium 0.9.5 13 Jul 2026
CVE-2026-45318: Open WebUI Stored XSS via Unsanitized Office File Previews 5.4 medium 0.9.3 13 Jul 2026
CVE-2026-45396: Open WebUI Feedback Form Mass Assignment Vulnerability 5.4 medium 0.9.5 14 May 2026
CVE-2026-45318: Open WebUI Stored XSS via Unsanitized Office File Previews 5.4 medium 0.9.3 14 May 2026
CVE-2026-70487: Open WebUI Cross-user File Content Disclosure Vulnerability 5.3 medium 0.11.0 10 Aug 2026
CVE-2026-70487: Open WebUI Cross-user File Content Disclosure Vulnerability 5.3 medium 0.11.0 04 Aug 2026
CVE-2026-59218: Open WebUI Account Enumeration via Login Timing Discrepancy 5.3 medium 0.10.0 04 Aug 2026
CVE-2026-59218: Open WebUI Account Enumeration via Timing Discrepancy 5.3 medium 0.10.0 24 Jul 2026
CVE-2026-45397: Open WebUI Unauthenticated RAG Configuration Disclosure Vulnerability 5.3 medium 0.9.5 13 Jul 2026
CVE-2026-45397: Open WebUI Unauthenticated RAG Configuration Disclosure Vulnerability 5.3 medium 0.9.5 14 May 2026
CVE-2026-0767: Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability 5.3 medium No fix published 23 Jan 2026
CVE-2024-7040: Open WebUI Improper Access Control Vulnerability 4.9 medium No fix published 20 Mar 2025
CVE-2026-45317: Open-WebUI Cross-Site Request Forgery (CSRF) Vulnerability via Image URL Manipulation 4.6 medium 0.9.3 13 Jul 2026
CVE-2026-45317: Open-WebUI Cross-Site Request Forgery Vulnerability via Image URL Manipulation 4.6 medium 0.9.3 14 May 2026
CVE-2026-87012: Open WebUI Calendar Alert Suppression Vulnerability 4.3 medium 0.11.1 01 Oct 2026
CVE-2026-87017: Open WebUI Knowledge Base Exposure Vulnerability 4.3 medium 0.11.1 01 Oct 2026
CVE-2026-87012: Open WebUI Calendar Alert Suppression via Non-Numeric Value 4.3 medium 0.11.1 10 Sep 2026
CVE-2026-87017: Open WebUI Knowledge Base Exposure Vulnerability 4.3 medium 0.11.1 10 Sep 2026
CVE-2026-70484: Open WebUI Image Generation Bypass for Revoked Users 4.3 medium 0.11.0 10 Aug 2026
CVE-2026-70484: Open WebUI Image Generation Bypass Vulnerability 4.3 medium 0.11.0 04 Aug 2026
CVE-2026-59223: Open WebUI Vulnerability in open-webui Allows Bypass of Host Allow/Block Filters 4.3 medium 0.10.0 04 Aug 2026
CVE-2026-59217: Open WebUI Arbitrary File Upload Bypass for Read-Only Users 4.3 medium 0.10.0 04 Aug 2026
CVE-2026-59227: Open WebUI Image Editing Bypass Vulnerability 4.3 medium 0.10.0 04 Aug 2026
CVE-2026-59223: Open WebUI Bypass Vulnerability in Host Allow/Block Filter 4.3 medium 0.10.0 24 Jul 2026
CVE-2026-59217: Open WebUI Arbitrary File Upload Bypass for Read-Only Users 4.3 medium 0.10.0 24 Jul 2026
CVE-2026-59227: Open WebUI Image Editing Bypass Vulnerability 4.3 medium 0.10.0 24 Jul 2026
CVE-2026-34225: Open WebUI Blind Server Side Request Forgery in Image Edit Functionality 4.3 medium No fix published 13 Jul 2026
CVE-2026-54016: Open WebUI BOLA Vulnerability Allows Unauthorized Knowledge Base File Enumeration 4.3 medium 0.9.6 13 Jul 2026
CVE-2026-54014: Open WebUI Path Traversal Vulnerability in Cache File Serving 4.3 medium 0.9.6 13 Jul 2026
CVE-2026-54006: Open WebUI Calendar Event IDOR Vulnerability 4.3 medium 0.9.6 13 Jul 2026
CVE-2026-45386: Open WebUI IDOR Vulnerability in pin_channel_message API Endpoint 4.3 medium 0.9.5 13 Jul 2026
CVE-2026-45387: Open WebUI Model Permission Misconfiguration Leading to System Prompt Leakage 4.3 medium 0.9.5 13 Jul 2026
CVE-2026-45385: Open WebUI IDOR Vulnerability in Message Update API 4.3 medium 0.9.5 13 Jul 2026
CVE-2026-34225: Open WebUI Blind Server Side Request Forgery in Image Edit Functionality 4.3 medium No fix published 07 Jul 2026
CVE-2024-7045: Open WebUI Arbitrary Prompt Read Due to Improper Access Control 4.3 medium No fix published 07 Jul 2026
CVE-2024-7046: Open WebUI Admin Details Exposure Vulnerability 4.3 medium No fix published 07 Jul 2026
CVE-2026-54016: Open WebUI Unauthorized Knowledge Base File Enumeration Vulnerability 4.3 medium 0.9.6 17 Jun 2026
CVE-2026-54014: Open WebUI Sibling-Prefix Path Traversal Vulnerability 4.3 medium 0.9.6 17 Jun 2026
CVE-2026-54006: Open WebUI IDOR Vulnerability Allows Unauthorized Calendar Event Re-parenting 4.3 medium 0.9.6 17 Jun 2026
CVE-2026-45387: Open WebUI Model Permission Misconfiguration Leading to System Prompt Leakage 4.3 medium 0.9.5 14 May 2026
CVE-2026-45386: Open WebUI IDOR Vulnerability in pin_channel_message API Endpoint 4.3 medium 0.9.5 14 May 2026
CVE-2026-45385: Open WebUI IDOR Vulnerability in Message Update API 4.3 medium 0.9.5 14 May 2026
CVE-2024-7045: Open WebUI Arbitrary Prompt Read Due to Improper Access Control 4.3 medium No fix published 20 Mar 2025
Improper Access Control in Open WebUI: Admin Details Exposure 4.3 medium No fix published 20 Mar 2025
CVE-2026-70480: Open WebUI Client-side SSRF Vulnerability via Unrestricted Resource Loading 4.1 medium 0.11.0 10 Aug 2026
CVE-2026-70480: Open WebUI Client-side SSRF via Unrestricted External Resource Loading in Vega/Vega-Lite Chart Rendering 4.1 medium 0.11.0 04 Aug 2026
CVE-2025-15603: Open WebUI JWT Key Handler Insufficient Randomness Vulnerability 3.7 low No fix published 09 Mar 2026
CVE-2026-59213: Open WebUI Cross-user Model-list Exposure Vulnerability 3.5 low 0.10.0 04 Aug 2026
CVE-2026-59213: Open WebUI Cross-user Model-list Exposure Due to Static Cache Key Misconfiguration 3.5 low 0.10.0 24 Jul 2026
CVE-2026-45316: Open WebUI Allows Read-Only Users to Toggle Note Pin Status via Incorrect Permission Check 3.5 low 0.9.3 13 Jul 2026
CVE-2026-45316: Open WebUI Allows Read-Only Users to Toggle Note Pin Status via Incorrect Permission Check 3.5 low 0.9.3 14 May 2026
CVE-2026-59215: Open WebUI Private Channel Message Disclosure Vulnerability 3.1 low 0.10.0 04 Aug 2026
CVE-2026-59715: Open WebUI Unauthenticated WebSocket Access Vulnerability 3.1 low 0.10.0 04 Aug 2026
CVE-2026-59226: Open WebUI Scheduled Automations Continue After User Deactivation 3.1 low 0.10.0 04 Aug 2026
CVE-2026-59215: Open WebUI Private Channel Message Disclosure Vulnerability 3.1 low 0.10.0 24 Jul 2026
CVE-2026-59715: Open WebUI Unauthenticated WebSocket Access Vulnerability 3.1 low 0.10.0 24 Jul 2026
CVE-2026-59226: Open WebUI Scheduled Automations Continue After User Deactivation 3.1 low 0.10.0 24 Jul 2026
CVE-2024-7038: open-webui File Enumeration and Directory Traversal Vulnerability 2.7 low No fix published 07 Jul 2026
CVE-2024-7038: open-webui Information Disclosure via File Enumeration and Directory Traversal 2.7 low No fix published 09 Oct 2024
CVE-2025-63681: open-webui Vulnerable to Incorrect Access Control 2.1 low No fix published 07 Jul 2026
CVE-2025-63681: open-webui Vulnerable to Incorrect Access Control 2.1 low No fix published 04 Dec 2025

Looking for another version, or everything Vulert holds for open-webui?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About open-webui 0.9.0

Is open-webui 0.9.0 vulnerable?

Yes. 177 vulnerabilities in the Vulert database cover open-webui 0.9.0: 0 critical, 71 high, 91 medium and 15 low. The upgrade Vulert recommends is 0.12.3, and each entry above names the fixed version to move to.

Which version of open-webui should I use instead of 0.9.0?

0.12.3 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 0.9.0 the latest release of open-webui?

No. 0.9.0 was published 21 Apr 2026, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor open-webui for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the open-webui version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.