Executive brief
Open WebUI, a popular interface for managing large language models, contains a security flaw in how it handles requests from other websites. If an administrator visits a malicious website while logged into Open WebUI, the attacker can secretly send commands to the interface. This could allow the attacker to take full control of the server running the software, potentially leading to data theft or complete system compromise.
Technical details
A CORS misconfiguration in multiple routers (including /api/v1/functions) allows arbitrary origins to make authenticated requests because the application reflects the origin when 'allow_origins' is set to '*'. When combined with a failure to properly invalidate sessions upon logout (CWE-613), an attacker can perform a one-click attack. By tricking an authenticated administrator into visiting a malicious site, the attacker can leverage the /api/v1/functions/create endpoint to inject and execute arbitrary Python code. In default Docker installations, this results in code execution as the root user within the container. The issue is patched in version 0.3.14.
Affected products
- open-webui open-webui < 0.3.14
Timeline
- 2026-05-05: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date