AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

open-webui

Open WebUI

Declares an LLM dependency since 2024-05-20 (version 0.1.124).

PyPILatest 0.11.4First release 2024-05-20Registry pageChecked 2026-10-09

Advisories

Advisories that name open-webui as affected. Advisory records do not state an ecosystem, so packages with the same name in other ecosystems also match. For a version-exact check of your own dependencies, use Stack Check.

Advisory	Severity	Affected	Fixed in	Published
CVE-2026-87994GHSA-fmqh-xp37-5hr8: Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint	Medium	>= 0.9.5, < 0.11.1	0.11.1	2026-09-10
CVE-2026-59213GHSA-3wp3-xxj9-5jqq: Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)	Low	>= 0.6.27, < 0.10.0	0.10.0	2026-07-24
CVE-2026-59715GHSA-gmfw-g93r-vg53: Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)	Low	>= 0.6.16, < 0.10.0	0.10.0	2026-07-24
CVE-2026-59227GHSA-rqj7-6wrp-6g2g: Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission	Medium	>= 0.8.11, < 0.10.0	0.10.0	2026-07-24
CVE-2026-54009GHSA-wch8-mhj5-9frg: Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field	Medium	<= 0.9.5	0.9.6	2026-06-17
CVE-2026-45675GHSA-h3ww-q6xx-w7x3: Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts	High	<= 0.8.12	0.9.0	2026-05-14
CVE-2026-45671GHSA-26g9-27vm-x3q8: Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion	High	<= 0.8.12	0.9.0	2026-05-14
CVE-2026-45667GHSA-m69w-p7m4-585j: Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)	Medium	<= 0.7.2	0.8.0	2026-05-14
CVE-2026-45402GHSA-r472-mw7m-967f: Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints	High	<= 0.9.4	0.9.5	2026-05-14
CVE-2026-45398GHSA-4g37-7p2c-38r9: Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls	High	<= 0.9.4	0.9.5	2026-05-14
CVE-2026-45397GHSA-65pg-qhhw-mxwg: Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure	Medium	< 0.9.5	0.9.5	2026-05-14
CVE-2026-45365GHSA-v6qf-75pr-p96m: Open WebUI: Authenticated users can bypass model access control via exposed query parameter [AI-ASSISTED]	Medium	<= 0.8.10	0.8.11	2026-05-14
CVE-2026-45351GHSA-jh9g-8jqw-m2qx: Open WebUI Exposes System Prompt to Regular User [Non-Admin]	Medium	<= 0.8.8	0.8.9	2026-05-14
CVE-2026-45346GHSA-r29h-37fj-x2w6: Open WebUI Has Stored Cross-Site Scripting in SVG Renderer	Medium	< 0.6.31	0.6.31	2026-05-14
CVE-2026-44571GHSA-jgj3-r8hr-9pjw: Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read Permission	Medium	<= 0.8.5	0.8.6	2026-05-11
CVE-2026-44567GHSA-4vg5-rp28-gvjf: Open WebUI has Improper Authorization Control	High	<= 0.1.123	0.1.124	2026-05-08
CVE-2026-29071GHSA-w9f8-gxf9-rhvw: Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories	Low	<= 0.8.5	0.8.6	2026-03-27
CVE-2026-28788GHSA-jjp7-g2jw-wh3j: Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite	High	< 0.8.6	0.8.6	2026-03-27
CVE-2026-28786GHSA-vvxm-vxmr-624h: Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`	Medium	< 0.8.6	0.8.6	2026-03-27

Dependencies of the latest release

As declared in PyPI metadata for version 0.11.4. Optional extras are listed with their extra name.

accelerateHugging Face Hub / Transformers
anthropicAnthropic SDK
chromadbChroma
colbert-ai[all]FAISS, Hugging Face Hub / Transformers
ddgsModel Context Protocol SDK
faster-whisperHugging Face Hub / Transformers
langchain-classicLangChain
langchain-coreLangChain
langchain-text-splittersLangChain
mcpModel Context Protocol SDK
openaiOpenAI SDK
pgvector[all]pgvector
pinecone[all]Pinecone
pymilvus[all]Milvus
qdrant-client[all]Qdrant
sentence-transformersHugging Face Hub / Transformers
transformersHugging Face Hub / Transformers
unstructured[all]Hugging Face Hub / Transformers
weaviate-client[all]Weaviate
oracledb[all]reaches LLM
pandasreaches LLM
elasticsearch[all]reaches LLM
sqlalchemyreaches LLM
alembicreaches LLM
blackreaches LLM
aiosqlitereaches LLM
asgirefreaches LLM
bcryptreaches LLM
google-cloud-storagereaches LLM
httpxreaches LLM
logurureaches LLM
onnxruntimereaches LLM
opensearch-pyreaches LLM
pillowreaches LLM
psutilreaches LLM
psycopgreaches LLM
pymysqlreaches LLM
pypdfreaches LLM
python-mimeparsereaches LLM
rank-bm25reaches LLM
requestsreaches LLM
sentencepiecereaches LLM
xlrdreaches LLM
aiodnsreaches LLM
aiohttpreaches LLM
cryptographyreaches LLM
fake-useragentreaches LLM
fastapireaches LLM
msoffcrypto-toolreaches LLM
pycrdtreaches LLM
pydanticreaches LLM
python-pptxreaches LLM
python-socketioreaches LLM
rapidocrreaches LLM
redisreaches LLM
tiktokenreaches LLM
youtube-transcript-apireaches LLM
aiocache
aiofiles
argon2-cffi
authlib
azure-ai-documentintelligence
azure-identity
azure-search-documents[all]
azure-storage-blob
beautifulsoup4
boto3
brotli
brotlicffi
chardet
docx2txt
einops
ftfy
googleapis-common-protos
google-re2
hiredis
itsdangerous
joserfc
ldap3
lxml
mariadb[mariadb]
markdown
opencv-python-headless
openpyxl
orjson
playwright[all]
psycopg2-binary[all]
pyarrow
pydub
pyjwt
pypandoc
python-docx
python-multipart
pytz
pyxlsb
regex
soundfile
starlette-compress
starsessions
uvicorn
validators

LLM components declared

Authority its dependencies grant

What code paths driven by a model could do if an attacker steers the model.

Browser control: Drives a browser, so it can act on websites with the user's sessions.
File system: Reads or writes files, so path traversal and data exposure are in reach.
Outbound HTTP: Makes outbound requests, the precondition for server-side request forgery and exfiltration.
MCP tools: Exposes or calls Model Context Protocol tools, which pass authority between agents and servers.

From: aiofiles, aiohttp, httpx, mcp, playwright, requests

Badge

Markdown

[![LLM exposure](https://aisecwatch.com/api/badge/llm/pypi/open-webui)](https://aisecwatch.com/packages/pypi/open-webui)

JSON for this package