high
CVE-2026-70492
Open WebUI before 0.11.0: 17-CVE batch - stored XSS in the Katex/markdown renderer, OAuth token-exchange account takeover, SSRF in the web loader and vega renderer, cross-tenant reads of tools/knowledge/chats, and an unsandboxed terminal iframe
- Severity
- high
- Affected product
- Open WebUI
- Affected versions
- Open WebUI < 0.11.0
- Fixed in
- Open WebUI 0.11.0
- Detection basis
- Component version range
- Shipped rule
- Open WebUI: Open WebUI before 0.11.0: 17-CVE batch - stored XSS in the Katex/markdown renderer, OAuth token-exchange account takeover, SSRF in the web loader and vega renderer, cross-tenant reads of tools/knowledge/chats, and an unsandboxed terminal iframe
- Added to NewScan
- 2026-08-05
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
COMPONENT VERSION RANGE
NewScan fingerprints Open WebUI from its response and reports this CVE when the detected version falls inside the affected range below.
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →Review the measured benchmark, then use the verified remediation process.