open-webui
- Software type
- Web application
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/13/2026, open-webui recorded 47 security vulnerabilities in the last 90 days, of which 22 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of open-webui and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-109572Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal ProxyCVE-2026-109300Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call EmbedsCVE-2026-109299Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule ValidationCVE-2026-109298Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search RegexCVE-2026-109297Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-109572Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-109300Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds | Exploitation statusActively exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109299Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109298Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex | Exploitation statusActively exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109297Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules | Exploitation statusNot confirmed | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109296Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes | Exploitation statusNot confirmed | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109295Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop | Exploitation statusActively exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109294Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109293Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint | Exploitation statusActively exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109292Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections | Exploitation statusNot confirmed | FixYes | Published10/12/2026 | SeverityHigh |
|---|
167 Results | Page 1 of 17