Open WebUI's 19 September Advisories: Which Ones Apply to Your Config

On 9 and 10 September 2026, the Open WebUI project published 19 security advisories, six of them rated high. Eighteen are fixed in open-webui 0.11.1, which PyPI shows was uploaded on 25 August 2026. The nineteenth, CVE-2026-88005, only affects the 0.8 line and was fixed in 0.9.0.

What makes this batch useful is that every advisory carries a "Preconditions" section. Most bugs need a non-default setting, such as OAuth, a terminal server, the Playwright web loader or a particular vector database. That lets you work out which ones actually apply to your instance instead of treating all 19 as live.

What's affected

• Package: open-webui on PyPI and the matching container images.
• Affected: ranges differ per advisory, from "before 0.11.1" (CVE-2026-87999) to narrower windows such as 0.10.0 up to 0.11.0. Every one of the 18 is fixed in 0.11.1. The current release is 0.12.3.
• Separate case: CVE-2026-88005 affects 0.8.x and is fixed in 0.9.0.

The six high severity issues and what they need:

• CVE-2026-87016 (8.1): OAuth or SCIM sign-in binds to the wrong account because the lookup uses a substring match. Needs: the SQLite backend (the default) plus OAuth, OIDC or SCIM enabled.
• CVE-2026-87995 (8.7): Script on a previewed terminal port runs in the Open WebUI origin and can steal the session token. Needs: an admin-configured shared terminal server (TERMINAL_SERVER_CONNECTIONS).
• CVE-2026-87996 (7.7): DNS rebinding sends the Playwright browser to internal hosts. Needs: WEB_LOADER_ENGINE=playwright.
• CVE-2026-87999 (7.1): Server-side fetch reaches 168.63.129.16, the Azure platform channel. Needs: a host on Azure, with ENABLE_LOCAL_WEB_FETCH at its default of false.
• CVE-2026-87998 (7.1): A user with write on one external knowledge base deletes the admin's shared connection. Needs: external knowledge bases on qdrant, milvus or pgvector.
• CVE-2026-87011 (7.5): Unauthenticated requests stall the event loop through uncached OIDC fetches. Needs: ENABLE_OAUTH_BACKCHANNEL_LOGOUT=true and an OIDC provider.

A few medium issues deserve a look too. CVE-2026-87015 sends a user's session cookies to tool servers configured for bearer auth, when two or more tool servers are attached and one uses session or system OAuth. CVE-2026-87017 returns knowledge bases a user can't access through the built-in knowledge tool on 11 of the 15 shipped vector backends, including both Qdrant clients, Elasticsearch, OpenSearch, Milvus, Pinecone and Weaviate. Chroma, the default, applies the filter and is not affected. CVE-2026-88001 skips both the host filter list and the private address check on redirect targets when AIOHTTP_CLIENT_ALLOW_REDIRECTS=true.

The rest are authenticated denial of service through cyclic chat or folder data, role changes from SSO that don't end live sessions, and cross-user writes in channels and folders.

How to check if you're exposed

Start with the version:

pip show open-webui | grep -i ^version
docker exec open-webui python -c "import importlib.metadata as m; print(m.version('open-webui'))"

Anything from 0.5.0 up to 0.11.0 is affected by at least CVE-2026-88002. Its advisory lists no precondition beyond one account with the default user role: a crafted chat history hangs the event loop for every user. Then dump the environment and compare it with the table:

docker exec open-webui env | grep -E \
  'DATABASE_URL|ENABLE_OAUTH|OAUTH_SUB_CLAIM|ENABLE_SCIM|TERMINAL_SERVER_CONNECTIONS|WEB_LOADER_ENGINE|ENABLE_LOCAL_WEB_FETCH|AIOHTTP_CLIENT_ALLOW_REDIRECTS|VECTOR_DB|WEBUI_AUTH_TRUSTED_ROLE_HEADER'

Read the output this way:

• No DATABASE_URL, or one starting with sqlite, plus any OAuth or SCIM setting means CVE-2026-87016 applies. If OAUTH_SUB_CLAIM points at a claim users can set themselves, such as a username or email, the advisory says an attacker can pick a value that matches an admin account.
• VECTOR_DB pointing at one of the 11 backends the advisory lists (anything other than Chroma, pgvector, MariaDB or Valkey) means CVE-2026-87017 applies.
• Running in Azure (VM, AKS or Container Apps) means CVE-2026-87999 applies to the platform channel address.

What to do now

1. Upgrade to 0.11.1 or later. The 0.12 line is current. Several advisories note that upgrading alone is enough, with no configuration change.
2. If you run SQLite with OAuth or SCIM, review recent sign-ins for accounts whose provider subject contains an underscore or percent sign. The advisory notes that even a legitimate subject with an underscore could resolve to another account.
3. Move production instances with many users to PostgreSQL. The advisory states the PostgreSQL code path was never affected by CVE-2026-87016.
4. If you enabled ENABLE_OAUTH_BACKCHANNEL_LOGOUT per the hardening guide, upgrade before anything else. CVE-2026-87011 needs no credentials at all.
5. Rotate sessions for users who called tools through more than one tool server, since CVE-2026-87015 could have handed their session token to a tool server operator.
6. Leave AIOHTTP_CLIENT_ALLOW_REDIRECTS at its default of false unless you need it.

Why it matters

Self-hosted chat front ends sit on top of a lot of trust. They hold sessions for every user, credentials for model providers, connections to vector databases and, increasingly, shell access through terminals and tools. A bug in any of those integrations becomes a bug in the front end.

The good news here is the disclosure format. Preconditions written per advisory, naming the exact environment variable, are what turn a list of 19 CVEs into a 10 minute triage. That is the same question reachability analysis answers for code: not "is the package present" but "is the vulnerable path live in this deployment".

Try it yourself

Pick one high severity advisory from the table and decide, from your own environment variables only, whether it is exploitable on your instance. Then compare your reasoning with an exploitability check:

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GHSA-wpmr-8h3q-fwj7: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite (CVE-2026-87016)
• GHSA-jmc6-2wr8-h3wj: Same-origin XSS via terminal port preview (CVE-2026-87995)
• GHSA-4v28-j6q3-5m4r: DNS rebinding in the Playwright web loader (CVE-2026-87996)
• GHSA-34r3-9m95-vq73: Azure platform channel reachable via web fetch (CVE-2026-87999)
• GHSA-2724-6cpj-gf3v: Non-admin deletion of external knowledge connections (CVE-2026-87998)
• GHSA-3g9q-v48f-hh9w: Uncached OIDC fetches in back-channel logout (CVE-2026-87011)
• GHSA-p78m-89r6-pgf7: Session cookies sent to bearer-auth tool servers (CVE-2026-87015)
• GHSA-pcvc-8vrv-8q6w: Knowledge tool ignores access filter on most vector backends (CVE-2026-87017)
• GHSA-5x7x-4c3c-qf5w: Unvalidated redirect targets in server-side fetches (CVE-2026-88001)
• Open WebUI v0.11.1 release
• open-webui on PyPI