# Openwebui Open Webui


- [CVE-2026-44551](https://insights.sbomify.com/CVE-2026-44551/): Open WebUI: LDAP Empty Password Authentication Bypass (critical 9.1)
- [CVE-2026-56400](https://insights.sbomify.com/CVE-2026-56400/): open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation (critical 9.0)
- [CVE-2024-8017](https://insights.sbomify.com/CVE-2024-8017/): Cross-site Scripting (XSS) in open-webui/open-webui (critical 9.0)
- [CVE-2026-45672](https://insights.sbomify.com/CVE-2026-45672/): Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed (high 8.8)
- [CVE-2026-87995](https://insights.sbomify.com/CVE-2026-87995/): Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin (high 8.7)
- [CVE-2026-70492](https://insights.sbomify.com/CVE-2026-70492/): Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages (high 8.7)
- [CVE-2026-54011](https://insights.sbomify.com/CVE-2026-54011/): Open WebUI: Stored XSS in Mermaid Markdown Preview (high 8.7)
- [CVE-2026-44552](https://insights.sbomify.com/CVE-2026-44552/): Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning (high 8.7)
- [CVE-2026-45315](https://insights.sbomify.com/CVE-2026-45315/): Open WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions (high 8.7)
- [CVE-2025-65959](https://insights.sbomify.com/CVE-2025-65959/): Open WebUI vulnerable to Stored DOM XSS via Note 'Download PDF' (high 8.7)
- [CVE-2025-64495](https://insights.sbomify.com/CVE-2025-64495/): Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE (high 8.7)
- [CVE-2026-56398](https://insights.sbomify.com/CVE-2026-56398/): Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI (high 8.5)

---
From sbomify Insights: https://insights.sbomify.com/products/openwebui/open-webui/