Executive brief
Open WebUI, a popular interface for interacting with large language models, contains security flaws that could allow an attacker to take over the system. By tricking an administrator into clicking a malicious link, an attacker can execute arbitrary code on the server. Because the application often runs with high privileges (root) in its default setup, this could lead to a complete compromise of the server and any data it manages.
Technical details
Open WebUI contains two primary vulnerabilities: a CORS misconfiguration (GHSL-2024-174) and a session management flaw (GHSL-2024-175). Multiple FastAPI routers use a permissive CORSMiddleware configuration with 'allow_origins=["*"]' and 'allow_credentials=True', which allows malicious websites to make authenticated cross-site requests. Simultaneously, the application fails to invalidate session cookies upon logout, extending the window of opportunity for an attacker. By leveraging these flaws, an attacker can perform a 'one-click' attack against an administrator to access the '/api/v1/functions' endpoint and execute arbitrary Python code. Since the default Docker deployment runs as root, this results in full container compromise. The issues are addressed in version 0.3.33.
Affected products
- Open WebUI open-webui < 0.3.33
Timeline
- 2026-05-05: disclosed
- 2026-05-11: advisory