PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44721 open-webui CVE debrief

A stored cross-site scripting (XSS) vulnerability in Open WebUI allows authenticated users with model creation permissions to execute arbitrary JavaScript in other users' browsers. The vulnerability exists in versions prior to 0.9.0 and was fixed in that release. The CVSS 3.1 score of 7.3 (HIGH) reflects network attack vector, low attack complexity, required privileges, and user interaction needed, with high impact to confidentiality and integrity. The weakness is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Vendor
open-webui
Product
Unknown
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-15
Original CVE updated
2026-05-19
Advisory published
2026-05-15
Advisory updated
2026-05-19

Who should care

Organizations running self-hosted Open WebUI instances with multiple authenticated users, particularly those with delegated model creation permissions. Security teams responsible for AI/ML platform security and administrators of internal AI chat interfaces.

Technical summary

Open WebUI versions prior to 0.9.0 contain a stored XSS vulnerability in the model creation functionality. Any authenticated user with workspace.models permission can embed malicious JavaScript within model definitions. When other users (including administrators) view the compromised model in the chat interface, the embedded script executes in their browser context. This enables session hijacking, privilege escalation, and unauthorized actions on behalf of victim users. The vulnerability requires low attack complexity and user interaction, with high impact to confidentiality and integrity per CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Open WebUI to version 0.9.0 or later to remediate this vulnerability.
  • Review and restrict workspace.models permissions to only trusted administrators until patching is complete.
  • Audit existing models for malicious JavaScript payloads, particularly those created by non-administrative users.
  • Implement Content Security Policy (CSP) headers as a defense-in-depth measure to mitigate XSS impact.
  • Monitor web application logs for suspicious model creation activity or unusual script execution patterns.

Evidence notes

CVE published 2026-05-15; NVD record modified 2026-05-19. Vendor advisory confirms exploitability and fix in version 0.9.0. CPE criteria confirms affected versions are all releases before 0.9.0.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44721 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44721

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44721 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44721

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.