Skip to content
Critical Open WebUI Vulnerability Enables Remote Code Execution

Critical Open WebUI Vulnerability Enables Remote Code Execution

First seen 12 May 2026, 17:59 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •May 13, 2026 at 17:32 UTC
  • •Open WebUI has a critical unpatched XSS vulnerability allowing RCE and account hijacking.
  • •The flaw is exploited via profile image uploads, affecting all users of the platform.
  • •No patch is currently available, increasing the urgency for users to take preventive measures.

A critical, unpatched vulnerability in Open WebUI allows attackers to exploit a stored Cross-Site Scripting (XSS) flaw through profile image uploads. This vulnerability enables 1-click Remote Code Execution (RCE), full account hijacking, and access to sensitive chat histories. Discovered by security researcher Metin Yunus Kandemir, the flaw poses a significant risk to users of the platform. Currently, there is no patch available, leaving systems vulnerable to exploitation. The flaw affects all users who utilize the profile image upload feature, potentially compromising AI workspaces and sensitive information. Security researchers have publicly disclosed the issue, emphasizing the urgency for users to secure their systems.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 130d ago How this analysis works

Timeline

2026-05-12
Vulnerability disclosed
Security researcher Metin Yunus Kandemir disclosed a critical XSS vulnerability in Open WebUI affecting profile image uploads.
Gbhackers
2026-05-12
Public warning issued
Researchers warned that the vulnerability allows 1-click RCE and full account hijacking, posing a severe risk to users.
Cybersecuritynews

More articles in this cluster (2)

Extracted Entities (3)

1 / 4