Open WebUI 0.11.2 ships as nine security advisories land

♥

Four breaking advisories disclosed September 1, five fixes followed September 5; the release also improves terminal previews and streaming performance.

77 commits 26 PRs merged 2 releases 10 security advisories 3 briefings covered

open-webui wire →

Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin open-webui/open-webui

The terminal port-preview iframe hardcodes allow-same-origin, letting same-origin XSS escalate to full account takeover. Review any custom tool or feature that embeds untrusted content in an iframe and ensure the sandbox attribute is restrictive.

Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends open-webui/open-webui

The built-in knowledge tool leaks inaccessible knowledge bases on most vector backends. If you use the tool, confirm your access-control rules are enforced at the backend, not only in the UI.

Channel members can overwrite another member's message via the chat completions endpoint open-webui/open-webui

Channel members can overwrite another member's message through the chat completions endpoint. This breaks message integrity assumptions in shared channels, so audit permissions and consider server-side ownership checks.

SSRF into internal services via DNS rebinding in the Playwright web loader open-webui/open-webui

The Playwright web loader allows SSRF into internal services via DNS rebinding. Restrict outbound network access from the loader and validate URLs against an allowlist to limit internal reachability.

Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout open-webui/open-webui

Uncached OIDC fetches in back-channel logout let unauthenticated requests stall the server, enabling denial of service. Cache OIDC discovery responses and rate-limit the logout endpoint to mitigate.

Any authenticated user can start a non-terminating request via a folder parent cycle open-webui/open-webui

Any authenticated user can start a non-terminating request by crafting a folder parent cycle. This can exhaust server resources, so enforce cycle detection in folder traversal logic and consider request timeouts.

A user's session cookies are sent to tool servers configured for bearer authentication open-webui/open-webui

Session cookies are sent to tool servers configured for bearer authentication, risking credential exposure. If you use bearer-authenticated tool servers, verify they are trusted and consider isolating cookie scopes.

perf: stop re-parsing the whole tool-argument buffer on every streamed chunk (#28858) open-webui/open-webui

Alongside the security work, 0.11.2 stops re-parsing the whole tool-argument buffer on every streamed chunk, cutting per-message overhead, and adds richer terminal file previews with clickable page thumbnails.

$ ls open-webui/week/ # the briefings behind this review

Mon Aug 31 Open WebUI 0.11.2 ships with tool parsing fix Tue Sep 1 Four breaking security advisories expose data and enable account takeover in Open WebUI Sat Sep 5 Open WebUI ships five security fixes for auth and request handling

open-webui wire →