CVE-2026-70486

Received Received - Intake

Open WebUI Origin Confusion via Terminal File Preview

Publication date: 2026-08-04

Last updated on: 2026-09-18

Assigner: GitHub, Inc.

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user with access to a configured terminal server could cause script in a previewed file to run in the Open WebUI origin, read the victim's session token from localStorage, and take over the account, with possible server-side code execution if the victim was an admin or held workspace.functions. This issue is fixed in 0.11.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-09-18

Generated

2026-10-19

AI Q&A

2026-08-04

EPSS Evaluated

2026-10-18

NVD

CVE-2026-70486

EUVD

EUVD-2026-52893

Affected Vendors & Products

Vendor	Product	Version / Range
openwebui	open_webui	From 0.9.0 (inc) to 0.11.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-1021	The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

Attack-Flow Graph

Executive Summary

CVE-2026-70486 is a Same-origin Cross-Site Scripting (XSS) vulnerability in Open WebUI versions 0.9.0 to 0.11.0. It allows an authenticated user with terminal server access to execute arbitrary scripts in the Open WebUI origin by exploiting the iframe file-preview feature. The vulnerability occurs because HTML file previews rendered in an iframe include the allow-same-origin sandbox attribute, which removes isolation when the file is served from the application's origin. This enables scripts in previewed files to read localStorage, including session tokens, leading to account takeover.

Detection Guidance

Check Open WebUI version with `curl -s http://localhost:8080/api/version | grep version` or via admin panel. If version is below 0.11.0, the system is vulnerable. Inspect network traffic for iframe requests to terminal-served files with `allow-same-origin` attributes.

Impact Analysis

An attacker could take over your Open WebUI account by tricking you into viewing a malicious HTML file in the terminal preview. If you are an admin or have workspace.functions privileges, the attacker might execute server-side code remotely. The attack requires at least one configured terminal server accessible to the victim and no additional interaction beyond having the chat open, as the preview opens automatically.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Account takeover and potential server-side code execution may result in data breaches, unauthorized disclosure, or modification of personal or health data, leading to compliance violations and legal consequences.

Mitigation Strategies

Upgrade Open WebUI to version 0.11.0 or later immediately. Disable terminal server access if not needed. Configure `iframeSandboxAllowSameOrigin` to false in settings. Apply CSP headers to iframe responses if custom deployment.

Hi! I’m here to help you understand CVE-2026-70486. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70