CVE-2026-26193: Open WebUI Stored XSS Vulnerability

CVE-2026-26193 Overview

CVE-2026-26193 is a stored cross-site scripting (XSS) vulnerability in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. Versions prior to 0.6.44 allow an authenticated user to manually modify chat history and set the embeds property on a response message. The platform loads this content into an iFrame sandboxed with both allow-scripts and allow-same-origin, bypassing the "iframe Sandbox Allow Same Origin" configuration. The flaw also persists when the chat is rendered in the shared format, producing a shareable link that delivers the payload to any other user on the same instance. The issue is tracked under [CWE-79] and is fixed in version 0.6.44.

Critical Impact
An authenticated attacker can craft a chat containing a malicious embeds payload and share its link, executing arbitrary JavaScript in the browser context of any recipient on the Open WebUI instance.

Affected Products

Open WebUI versions prior to 0.6.44
Self-hosted Open WebUI instances exposing chat sharing functionality
Multi-user Open WebUI deployments where shared chat links are distributed

Discovery Timeline

2026-02-19 - CVE-2026-26193 published to NVD
2026-02-20 - Last updated in NVD database

Technical Details for CVE-2026-26193

Vulnerability Analysis

The vulnerability resides in the chat response rendering logic of Open WebUI, specifically the component handling the embeds property on response messages. When a chat is displayed, the application loads embed content into an iFrame and applies a sandbox attribute. The sandbox is configured with both allow-scripts and allow-same-origin, which together negate the security boundary the sandbox is intended to provide. Scripts running inside the iFrame retain access to the parent origin's DOM, cookies, and localStorage.

The administrative "iframe Sandbox Allow Same Origin" setting is ignored for this code path, so operators who disable that option remain exposed. Because the payload is persisted in chat history, every viewer of the chat — including recipients of a shared link — executes the injected script.

Root Cause

The root cause is improper neutralization of input during web page generation. The renderer trusts the embeds field on response messages, which any authenticated user can populate by manually modifying chat history through the API. The sandbox flags applied to the resulting iFrame do not enforce origin isolation, and the configurable same-origin restriction is not consulted in this render path. See the GitHub Security Advisory GHSA-vjm7-m4xh-7wrc for vendor confirmation.

Attack Vector

Exploitation requires an authenticated account on the target Open WebUI instance and user interaction from the victim. The attacker modifies chat history to include a malicious embeds value, then shares the chat link with other users on the instance. When a victim opens the link, the iFrame loads with allow-scripts allow-same-origin, and the injected JavaScript executes within the Open WebUI origin. This enables session theft, account takeover, exfiltration of chat data, and pivoting to administrative functions if the victim is privileged.

No verified exploit code has been published. The vulnerable rendering logic can be reviewed in the ResponseMessage.svelte source file.

Detection Methods for CVE-2026-26193

Indicators of Compromise

Chat history records containing an embeds property with <script> tags, event handlers, or javascript: URIs
Outbound requests from user browsers to attacker-controlled domains shortly after opening a shared chat link
Unexpected session token or API key access patterns originating from authenticated Open WebUI users
Newly created or modified shared chat URLs distributed across the instance by non-administrative accounts

Detection Strategies

Audit the Open WebUI database for response messages where the embeds field contains HTML, JavaScript, or iframe markup not produced by legitimate model output
Inspect web server and reverse proxy logs for PATCH/POST requests modifying chat objects with embed payloads
Monitor Content Security Policy violation reports if CSP is enforced in front of Open WebUI

Monitoring Recommendations

Enable verbose application logging for chat creation, modification, and share-link generation events
Forward Open WebUI access logs and browser telemetry to a centralized analytics pipeline for correlation
Alert on anomalous bursts of shared chat link access across multiple user accounts within short time windows

How to Mitigate CVE-2026-26193

Immediate Actions Required

Upgrade all Open WebUI deployments to version 0.6.44 or later without delay
Invalidate active sessions and rotate API keys for accounts that may have opened malicious shared chats
Review existing chat history and remove any records containing untrusted embeds content
Restrict account registration on internet-exposed instances until patching is complete

Patch Information

Open WebUI version 0.6.44 fixes the vulnerability by correcting the iFrame sandbox handling for the embeds property and honoring the "iframe Sandbox Allow Same Origin" configuration. Refer to the GitHub Security Advisory GHSA-vjm7-m4xh-7wrc for release details.

Workarounds

Disable chat sharing functionality on the instance until the upgrade is applied
Place Open WebUI behind a reverse proxy enforcing a strict Content Security Policy that blocks inline scripts and untrusted frame sources
Limit instance access to trusted users through network controls or SSO until patched versions are deployed

bash

# Upgrade Open WebUI container to the patched release
docker pull ghcr.io/open-webui/open-webui:0.6.44
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.6.44