CVE-2026-70484 open-webui CVE debrief

Who should care

Defenders and administrators of Open WebUI instances should assess exposure and prioritize remediation. They should verify image provider usage and API credit consumption, restrict access to image generation features for users with revoked permissions, and monitor chat completion activity for suspicious behavior. Security teams and vulnerability management teams should also review and restrict image provider access and API credits.

Why it matters

CVE-2026-70484 allows authenticated users with revoked image-generation permissions to consume image provider resources via chat completions, requiring defenders to verify exposure and remediate vulnerable instances.

• Verify image provider usage and API credit consumption
• Restrict access to image generation features for users with revoked permissions
• Monitor chat completion activity for suspicious behavior

Technical summary

The legacy chat-completions feature in Open WebUI from version 0.7.0 to 0.10.0 did not properly check the image_generation permission, allowing authenticated users with revoked permissions to consume image provider resources. This issue is fixed in version 0.11.0. Defenders should prioritize verifying exposure and remediating vulnerable Open WebUI instances, focusing on affected product context and defensive impact without unsupported root-cause or exploit claims. The vulnerability affects Open WebUI instances with image generation features enabled.

Defensive priority

Defenders should prioritize verifying exposure and remediating vulnerable Open WebUI instances.

Recommended defensive actions

• Verify Open WebUI instance exposure and upgrade to version 0.11.0 or later
• Review and restrict image provider access and API credits
• Monitor for suspicious chat completion activity
• Verify image provider usage and API credit consumption
• Restrict access to image generation features for users with revoked permissions
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, which was fixed in Open WebUI version 0.11.0. Evidence is limited to public CVE and NVD information. Defenders should verify Open WebUI instance exposure and review image provider access and API credits. The vulnerability allows authenticated users with revoked image-generation permissions to consume image provider resources via chat completions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.