Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.44, aanually modifying chat history allows setting the `embeds` property on a response message, the content of which is loaded into an iFrame with a sandbox that has `allow-scripts` and `allow-same-origin` set, ignoring the "iframe Sandbox Allow Same Origin" configuration. This enables stored XSS on the affected chat. This also triggers when the chat is in the shared format. The result is a shareable link containing the payload that can be distributed to any other users on the instance. Version 0.6.44 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-08 | 1 | General1 |
| 2026-03-15 | 1 | Disclosure1 |
| 2026-03-16 | 1 | Disclosure1 |
| 2026-03-17 | 1 | Disclosure1 |
| 2026-03-18 | 1 | Patch1 |
CVE-2026-26193 has been published with a CVSS score of 7.3. Open WebUI is a self-hosted artificial intelligence.... Add it to your patching queue if applicable. Details: https://threatops.tech/exploit-radar #CVE #InfoSec #VulnMgmt
Post summary
The post announces CVE‑2026‑26193, lists its 7.3 CVSS score, urges adding it to patch queues, and links to a threat‑operations page for further details.
New vulnerability disclosed: CVE-2026-26193 with a CVSS score of 7.3. Open WebUI is a self-hosted artificial intelligence.... Worth reviewing if this affects your stack. Details: https://threatops.tech/exploit-radar #CVE #InfoSec #VulnMgmt
Post summary
The text announces the exposure of CVE-2026-26193 with a CVSS score of 7.3 and encourages users to review its relevance, but no PoC, exploit, or patch information is provided.
New vulnerability disclosed: CVE-2026-26193 with a CVSS score of 7.3. Open WebUI is a self-hosted artificial intelligence.... Worth reviewing if this affects your stack. Details: https://threatops.tech/exploit-radar #CVE #InfoSec #VulnMgmt
Post summary
A new vulnerability, CVE-2026-26193, has been disclosed for Open WebUI with a CVSS score of 7.3, and a link to additional details is provided.
Security advisory: CVE-2026-26193 with a CVSS score of 7.3. Open WebUI is a self-hosted artificial intelligence.... Check if you need to take action. Details: https://threatops.tech/exploit-radar #CVE #InfoSec #VulnMgmt
Post summary
The text announces CVE-2026-26193 with a CVSS score of 7.3, refers to Open WebUI, and links to an external page for more details, but offers no proof of exploitation, remediation, or technical specifics.
Just published: Critical Analysis CVE-2026-26193 - Open WebUI is a self-hosted artificial.... Practical security guidance from the trenches. Read more: https://threatops.tech/blog/critical-analysis-cve-2026-26193-open-webui-is-a-self-hosted-artificial-intelligence-platform-march
Post summary
The text announces a blog post about CVE-2026-26193 but does not provide evidence of PoC, exploit availability, active exploitation, patches, or detailed technical information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openwebui | open_webui | - | - | - |