CVE-2026-70486 in Open WebUI
Summary
by MITRE • 08/04/2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user with access to a configured terminal server could cause script in a previewed file to run in the Open WebUI origin, read the victim's session token from localStorage, and take over the account, with possible server-side code execution if the victim was an admin or held workspace.functions. This issue is fixed in 0.11.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/04/2026
This vulnerability exists within the Open WebUI platform, a self-hosted AI solution that has been widely adopted for its extensible features and user-friendly interface. The security flaw specifically affects versions between 0.9.0 and 0.11.0, creating a critical access control bypass that allows authenticated users to execute arbitrary code within the application context. The vulnerability stems from improper sandboxing of file previews in the terminal functionality, where HTML files served from the application origin receive overly permissive iframe permissions through the allow-same-origin and allow-scripts directives. This configuration creates a dangerous privilege escalation scenario where malicious actors can leverage the preview functionality to inject and execute scripts within the Open WebUI domain context.
The technical exploitation of this vulnerability involves a sophisticated cross-site scripting attack vector that leverages the terminal file preview feature's iframe sandboxing mechanism. When an authenticated user accesses a malicious HTML file through the terminal interface, the browser executes the embedded JavaScript code within the application's origin context due to the overly permissive iframe permissions. This allows attackers to read session tokens stored in localStorage, effectively enabling account takeover attacks that can be executed with the privileges of any victim who views the malicious file. The vulnerability particularly impacts administrative accounts or users with workspace.functions permissions, as these users may have elevated system access that could lead to complete server compromise.
The operational impact of this vulnerability extends beyond simple session hijacking to encompass potential full system compromise and data exfiltration capabilities. Attackers can leverage this vulnerability to execute arbitrary code on the server side, potentially gaining access to sensitive user data, system resources, and administrative functions within the Open WebUI environment. The issue is particularly concerning because it affects a self-hosted platform where organizations rely on local security controls, making the exploitation of such vulnerabilities potentially devastating for enterprise environments that depend on these solutions for AI workloads and collaborative development. This vulnerability represents a critical failure in the principle of least privilege and proper sandboxing implementation.
The mitigation strategy involves updating to version 0.11.0 or later, which implements proper iframe sandboxing restrictions that prevent scripts from executing with elevated privileges when previewing files. Security practitioners should also implement additional protective measures including strict content security policy headers, regular security audits of file handling mechanisms, and monitoring for unusual file preview access patterns within application logs. This vulnerability aligns with CWE-1004 which addresses insecure default permissions and CWE-352 which covers cross-site request forgery issues. The attack pattern corresponds to ATT&CK technique T1078 which involves valid accounts and T1566 which encompasses social engineering tactics. Organizations should conduct comprehensive security assessments of their Open WebUI deployments and implement network segmentation controls to limit potential lateral movement if such vulnerabilities are present in older versions.