CVE-2024-7806: Open WebUI Remote Code Execution Flaw

CVE-2024-7806 Overview

CVE-2024-7806 is a Cross-Site Request Forgery (CSRF) vulnerability in open-webui versions <= 0.3.8 that enables remote code execution by non-admin users. The application authenticates users with cookies configured with the SameSite=lax attribute and does not implement CSRF tokens. An attacker can host malicious HTML that, when visited by an authenticated victim, submits requests to modify the Python code of an existing pipeline. The modified pipeline executes arbitrary code under the victim's privileges. This weakness is tracked under CWE-352.

Critical Impact
A single victim click on attacker-controlled content is sufficient to achieve arbitrary code execution in the context of the open-webui pipeline runtime.

Affected Products

open-webui/open-webui versions <= 0.3.8
Deployments exposing the open-webui pipelines feature to authenticated users
Environments where users authenticate through browsers sharing cookies with third-party sites

Discovery Timeline

2025-03-20 - CVE-2024-7806 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7806

Vulnerability Analysis

Open-webui is a self-hosted web interface for interacting with large language models. The platform supports "pipelines," server-side Python code executed to preprocess or transform model interactions. Authenticated users, including non-admin roles, can reach pipeline modification endpoints. The vulnerability arises from two combined design decisions: authentication cookies use SameSite=lax, and state-changing endpoints do not require anti-CSRF tokens. Together these allow cross-origin form submissions to trigger privileged actions on behalf of the victim.

Root Cause

The root cause is missing CSRF protection on endpoints that mutate pipeline source code. The SameSite=lax cookie attribute permits cookies to accompany top-level cross-site navigations, so an attacker-crafted page that triggers a same-site navigation or form submission carries the victim's session credentials. Without a synchronizer token, origin verification, or double-submit cookie pattern, the server cannot distinguish a legitimate request from a forged one.

Attack Vector

Exploitation requires the victim to visit an attacker-controlled webpage while authenticated to a vulnerable open-webui instance. The malicious page issues a request to a pipeline modification endpoint containing attacker-supplied Python. When the open-webui backend processes the request, it overwrites the pipeline source with the attacker's code. The next execution of that pipeline runs arbitrary Python inside the open-webui process. Because the victim's role determines authorization, even non-admin accounts with pipeline access are sufficient to reach code execution.

No verified proof-of-concept code is published. Technical details are documented in the Huntr Bounty Report.

Detection Methods for CVE-2024-7806

Indicators of Compromise

Unexpected modifications to pipeline Python source files or database records containing pipeline definitions.
Outbound network connections from the open-webui process to unfamiliar hosts, which may indicate reverse shells or data staging.
HTTP requests to pipeline modification endpoints where the Referer or Origin header points to a domain outside the deployment.
New processes spawned as children of the open-webui runtime that are inconsistent with normal pipeline behavior.

Detection Strategies

Enable application-level audit logging for pipeline create, update, and delete operations, and alert on changes originating from non-admin accounts.
Inspect reverse proxy or WAF logs for POST or PUT requests to pipeline endpoints with cross-origin Referer headers.
Deploy endpoint monitoring on the open-webui host to identify anomalous Python subprocess activity or unexpected outbound connections.

Monitoring Recommendations

Centralize open-webui logs and correlate authentication events with pipeline modifications to reconstruct any suspicious sequence of actions.
Track user-agent, source IP, and session identifiers on requests to pipeline endpoints to identify anomalies consistent with browser-driven CSRF.
Alert on file integrity changes to on-disk pipeline definitions outside of maintenance windows.

How to Mitigate CVE-2024-7806

Immediate Actions Required

Upgrade open-webui to a version later than 0.3.8 that addresses the CSRF weakness.
Restrict network exposure of the open-webui interface to trusted networks or authenticated VPN users.
Audit existing pipeline definitions for unauthorized modifications and restore known-good versions where necessary.
Rotate credentials and session tokens for accounts that may have been targeted.

Patch Information

Upgrade to a fixed release of open-webui above version 0.3.8. Consult the Huntr Bounty Report for disclosure details and refer to the open-webui project repository for the specific patched release.

Workarounds

Configure the reverse proxy in front of open-webui to enforce Origin and Referer header validation on state-changing requests.
Set authentication cookies to SameSite=strict where deployment allows, reducing cross-site cookie transmission.
Restrict pipeline modification permissions to a minimal set of admin accounts and disable non-admin write access to pipelines.
Require users to access open-webui from a dedicated browser profile that does not visit untrusted sites during the session.

bash

# Example nginx snippet enforcing same-origin on state-changing requests
map $request_method $enforce_origin {
    default 0;
    POST    1;
    PUT     1;
    PATCH   1;
    DELETE  1;
}

server {
    listen 443 ssl;
    server_name openwebui.example.com;

    location / {
        if ($enforce_origin) {
            set $origin_ok 0;
            if ($http_origin = "https://openwebui.example.com") { set $origin_ok 1; }
            if ($origin_ok = 0) { return 403; }
        }
        proxy_pass http://127.0.0.1:8080;
    }
}