On 12 October 2026, NVD published 19 CVEs for Open WebUI in one batch. Every one of them reads "before 0.11.4", so a single upgrade closes them all. Four are rated high (CVSS 3.1 between 7.3 and 8.1), fifteen medium. Most need a signed-in account, which on a personal install sounds harmless. On a team instance, or any instance with open sign-up, it is not: the medium ones include ways for an ordinary user to take an administrator's session.
The ones to read first
CVE-2026-109286, CVSS 8.1, no account
needed. From 0.7.0, the SyncStatsModal component accepted
verify:chat messages from any origin. A website the victim visits
while signed in can post such a message with a path-traversal chat id,
redirect the stats export request to the auth endpoint and receive the
victim's JWT, which is full API access as that user
(GHSA-vpq8-f445-hcq7).
If the victim is an admin, the attacker now runs the instance.
CVE-2026-109572, CVSS 7.6. From 0.8.6, the terminal proxy let any authenticated user reach the Terminals administrator API with the shared key attached: list or stop other users' terminals and change terminal policies, including injecting environment variables into other users' terminals (GHSA-q46m-r89w-j74p). A related bug, CVE-2026-109289, let deactivated users keep running commands through a terminal WebSocket that was already open, because access was only checked on the first message.
CVE-2026-109290 and
CVE-2026-109291, CVSS 7.3. Stored XSS through
a crafted DOCX attachment rendered by the preview component (from
0.11.1), and through javascript: URLs stored in citation fields (from
0.6.33). In both cases the script reads the session token from local
storage. An administrator who previews the wrong file, or clicks the
wrong citation in a shared chat, hands over the instance.
The rest, grouped
- More session theft. CVE-2026-109288 is another stored XSS, through markdown link URLs whose scheme was not checked, and CVE-2026-109300 runs script through user-authored tool-call blocks rendered in iframes. CVE-2026-109292 is different and worth knowing if you connect third-party servers: on OAuth-mode connections the full browser cookie jar was forwarded, so the operator of an OpenAI-compatible endpoint, an OpenAPI tool server or a terminal server could capture and replay users' session cookies.
- Access control that outlived the permission. Former knowledge base collaborators kept access to removed files through cached references (CVE-2026-109285); read-only folder members could still fork chats into the folder (CVE-2026-109284); the OAuth token exchange kept a user's previous role when the identity provider no longer granted it (CVE-2026-109283).
- Information disclosure. Read-only shared tools could be exported with their full Python source, including any API keys embedded in it (CVE-2026-109293); disabled model backends stayed reachable by index, with their configured API keys attached (CVE-2026-109296); knowledge base listings leaked folder names and owner ids (CVE-2026-109287).
- Denial of service by any user. Gzip-compressed remote images decompressed without limit (CVE-2026-109294), catastrophic regular expressions in the file search tools (CVE-2026-109295, CVE-2026-109298) and automation recurrence rules that block the event loop (CVE-2026-109297, CVE-2026-109299).
What to do
- Upgrade to 0.11.4 or later. For Docker, pin a version tag (0.11.4 or newer) rather than
main, so the version you run is the version you checked. - Keep sign-up closed (or set new accounts to pending) unless you really run a public service. Fifteen of these CVEs start with "an authenticated user".
- Do not connect tool servers, terminal servers or OpenAI-compatible endpoints you do not operate. CVE-2026-109292 shows they can see more than the request you meant to send them.
- After upgrading, sign everyone out (rotate the
WEBUI_SECRET_KEYif you can afford the forced re-login). Tokens stolen through the XSS bugs above stay valid until they expire. - Review admin accounts and terminal policies for changes you did not make, and rotate the API keys of every backend Open WebUI holds.
Keep watching
Open WebUI ships fast and gets audited hard: an NVD keyword search for
it returns 164 CVEs as of this week. The live list is at Open WebUI CVEs.
If it fronts an Ollama server, the Ollama /api/pull CVEs
of the same month matter too. Paste your docker-compose.yml into the
stack scanner to see which CVEs hit the exact tags you run.