CVE-2026-45665 Overview
CVE-2026-45665 is a Stored Cross-Site Scripting (XSS) vulnerability in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. The flaw resides in the Banner component and stems from an improper sanitization order, where DOMPurify executes before the marked library processes Markdown content. A compromised or malicious administrator can plant a payload in the global banner, which renders for every user — including the Super Admin (Primary Admin). The attack vector enables privilege escalation by stealing the Super Admin's session token. The vulnerability affects all Open WebUI versions prior to 0.8.0 and is tracked as [CWE-79].
Critical Impact
An administrator-level attacker can escalate privileges to Super Admin by hijacking the Primary Admin's session through a malicious banner payload.
Affected Products
- Open WebUI versions prior to 0.8.0
- Self-hosted Open WebUI deployments with multiple administrators
- Open WebUI instances using the global Banner component
Discovery Timeline
- 2026-05-15 - CVE-2026-45665 published to NVD
- 2026-05-19 - Last updated in NVD database
Technical Details for CVE-2026-45665
Vulnerability Analysis
The vulnerability exists in the Banner rendering pipeline of Open WebUI. The application invokes DOMPurify to sanitize banner content before passing the result to the marked library for Markdown-to-HTML conversion. This inverted order breaks the sanitization guarantee. Markdown syntax that appears benign to DOMPurify expands into executable HTML after marked processes it. The result is stored HTML and JavaScript that persists in the global banner configuration and executes in every user's browser session.
Because banners render for all authenticated users, the payload executes in the Super Admin's browser context once that account loads any page containing the banner. The attacker can exfiltrate the localStorage or cookie-based session token, then reuse it to impersonate the Primary Admin and gain full platform control.
Root Cause
The root cause is incorrect ordering of two sanitization and rendering operations. Sanitization must occur after Markdown rendering produces final HTML, not before. By running DOMPurify against raw Markdown, the application sanitizes a different representation than what is eventually injected into the DOM. The fix in version 0.8.0 reorders the pipeline so that marked produces HTML first and DOMPurify removes dangerous constructs before insertion.
Attack Vector
Exploitation requires an authenticated administrator account with permission to modify the global banner. The attacker stores a crafted Markdown payload that survives DOMPurify but produces script-equivalent HTML after marked processing. When the Super Admin loads any view containing the banner, the payload executes in their browser, reads session credentials, and transmits them to an attacker-controlled endpoint. The Open WebUI security advisory at GHSA-cqp4-qqvg-3787 describes the bypass mechanism in detail.
Detection Methods for CVE-2026-45665
Indicators of Compromise
- Unexpected outbound HTTP/HTTPS requests from administrator browser sessions to unfamiliar domains shortly after loading the Open WebUI interface.
- Unauthorized changes to the global banner configuration in the Open WebUI admin settings or database.
- New Super Admin sessions originating from IP addresses or user agents that do not match the legitimate Primary Admin.
- Banner content containing Markdown constructs that resolve to <script>, <img onerror>, or event-handler attributes after rendering.
Detection Strategies
- Audit the Open WebUI banner configuration table for entries containing HTML event handlers, javascript: URIs, or encoded script payloads.
- Compare Open WebUI version strings against 0.8.0 to identify vulnerable deployments across the environment.
- Review reverse-proxy and web application firewall logs for anomalous administrator activity preceding banner updates.
Monitoring Recommendations
- Enable verbose audit logging on Open WebUI administrative endpoints, particularly those handling banner and configuration changes.
- Monitor Content Security Policy (CSP) violation reports from browsers loading the Open WebUI frontend.
- Alert on session token reuse from disparate geographic locations or user agents for any account with Super Admin privileges.
How to Mitigate CVE-2026-45665
Immediate Actions Required
- Upgrade all Open WebUI instances to version 0.8.0 or later without delay.
- Review the current banner configuration and remove any content of unverified origin.
- Rotate Super Admin and administrator session tokens and API keys after patching.
- Audit the administrator user list and remove or downgrade accounts that no longer require elevated privileges.
Patch Information
The vulnerability is fixed in Open WebUI 0.8.0. The patch reorders the sanitization pipeline so that the marked library renders Markdown to HTML before DOMPurify sanitizes the resulting DOM fragment. Refer to the Open WebUI Security Advisory GHSA-cqp4-qqvg-3787 for upgrade guidance and release notes.
Workarounds
- Disable the global banner feature entirely until the upgrade to 0.8.0 is complete.
- Restrict administrator account provisioning to a minimal, trusted set of users to reduce the population capable of planting a payload.
- Deploy a strict Content Security Policy in front of Open WebUI that blocks inline scripts and unauthorized external script sources.
- Place Open WebUI behind a web application firewall configured to inspect and block administrative requests containing suspicious Markdown or HTML.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
