CVE-2026-54007: Open WebUI CSRF Vulnerability

CVE-2026-54007 Overview

CVE-2026-54007 affects Open WebUI, a self-hosted artificial intelligence platform that runs entirely offline. Versions prior to 0.9.6 fail to validate the origin of postMessage events received by the chat message listener. An external attacker-controlled page can post input:prompt and action:submit messages that trigger submitPrompt() inside an authenticated victim session. The browser then issues POST /api/v1/chats/new and POST /api/chat/completions requests carrying attacker-controlled prompts. The flaw is tracked as CWE-346: Origin Validation Error and resolved in release 0.9.6.

Critical Impact
Cross-origin attackers can force prompt submission, tool invocation, and model execution under a victim's authenticated Open WebUI session without consent.

Affected Products

Open WebUI versions prior to 0.9.6
Self-hosted Open WebUI deployments exposed to authenticated user browsers
Open WebUI instances using default chat message listener configuration

Discovery Timeline

2026-06-23 - CVE-2026-54007 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54007

Vulnerability Analysis

Open WebUI registers a message event listener in the chat interface to handle inter-frame communication. The listener processes structured events such as input:prompt (sets the prompt textarea) and action:submit (invokes submitPrompt()). The listener does not verify event.origin against an allowlist before acting on incoming data.

When a user with an active Open WebUI session visits a malicious page, that page can open or embed the Open WebUI window and use window.postMessage() to deliver crafted events. The victim browser executes the handler in the Open WebUI origin context, attaching the session cookie to outbound API calls. This bypasses the same-origin protection developers typically assume postMessage consumers enforce.

The resulting requests to /api/v1/chats/new and /api/chat/completions reach the backend with full user privileges. Attackers can inject prompts, invoke connected tools, exfiltrate data through model responses, or pivot to integrated agents.

Root Cause

The root cause is missing origin validation inside the chat message listener. The handler accepts any MessageEvent regardless of event.origin, violating the security model for window.postMessage consumers.

Attack Vector

Exploitation requires the victim to be authenticated to Open WebUI and to visit or render an attacker-controlled page. The attacker page opens the Open WebUI URL or references an existing tab and dispatches postMessage payloads containing input:prompt and action:submit events. No additional privileges are required from the attacker, and the victim performs only a single click or page visit. For technical details, see the Open WebUI GitHub Security Advisory GHSA-3vv5-8xxp-4f55.

Detection Methods for CVE-2026-54007

Indicators of Compromise

Unexpected POST /api/v1/chats/new and POST /api/chat/completions entries in Open WebUI access logs with Referer or Sec-Fetch-Site headers indicating cross-site origin.
Chat history entries created at times the user was not actively interacting with Open WebUI.
Outbound tool or model calls referencing prompts the user did not author.

Detection Strategies

Inspect reverse proxy and Open WebUI logs for chat creation requests where Sec-Fetch-Site: cross-site is present.
Correlate browser session activity with chat creation timestamps to spot involuntary submissions.
Alert on bursts of new chats from a single session within short windows, which suggests automated cross-origin posting.

Monitoring Recommendations

Forward Open WebUI application logs and proxy logs to a centralized analytics platform and retain Referer, Origin, and Sec-Fetch-* headers.
Monitor browser telemetry for users loading Open WebUI alongside untrusted domains in concurrent tabs.
Track invocations of connected tools and external model endpoints for unusual prompt patterns.

How to Mitigate CVE-2026-54007

Immediate Actions Required

Upgrade Open WebUI to version 0.9.6 or later on every self-hosted instance.
Restrict Open WebUI access to trusted networks or VPN until the upgrade is complete.
Force re-authentication and invalidate active sessions after patching to clear any abused tokens.

Patch Information

The maintainers fixed CVE-2026-54007 in Open WebUI 0.9.6 by adding origin validation to the chat message listener. Refer to the Open WebUI GitHub Security Advisory GHSA-3vv5-8xxp-4f55 for the official fix and release notes.

Workarounds

Deploy a reverse proxy rule that rejects requests to /api/v1/chats/new and /api/chat/completions when Sec-Fetch-Site is cross-site.
Set a strict Content-Security-Policy with frame-ancestors 'self' to block embedding Open WebUI in attacker frames.
Instruct users to access Open WebUI in a dedicated browser profile that does not load untrusted sites.

bash

# Example nginx hardening to block cross-site requests until patched
location ~ ^/api/(v1/chats/new|chat/completions)$ {
    if ($http_sec_fetch_site = "cross-site") { return 403; }
    proxy_pass http://open_webui_backend;
    add_header Content-Security-Policy "frame-ancestors 'self'" always;
}