CVE-2026-70486: Open WebUI XSS Vulnerability

CVE-2026-70486 Overview

CVE-2026-70486 is a stored cross-site scripting (XSS) vulnerability in Open WebUI, an extensible self-hosted AI platform. Versions from 0.9.0 up to 0.11.0 contain a flawed iframe sandbox configuration in the terminal file-preview component. The serveUrl iframe branch always granted allow-same-origin alongside allow-scripts for HTML files served from the application origin. Any authenticated user with access to a configured terminal server could serve a malicious HTML file that executes JavaScript within the Open WebUI origin. The attacker can read the victim's session token from localStorage, hijack the account, and reach server-side code execution when the victim holds admin privileges or workspace.functions access. The issue is tracked under CWE-79 and fixed in version 0.11.0.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in the Open WebUI origin, steal session tokens, take over accounts, and achieve remote code execution against admin victims.

Affected Products

Open WebUI 0.9.0 through 0.10.x
Open WebUI deployments configured with a terminal server file-preview feature
Self-hosted Open WebUI instances allowing authenticated user file uploads to terminal-served paths

Discovery Timeline

2026-08-04 - CVE-2026-70486 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70486

Vulnerability Analysis

Open WebUI renders previewed files inside an HTML iframe using the terminal server's serveUrl. The iframe's sandbox attribute simultaneously granted allow-scripts and allow-same-origin. Because the preview content is served from the same origin as the application, the sandbox provided no isolation. Scripts inside the previewed HTML executed with full access to the parent origin's DOM, cookies (non-HttpOnly), and localStorage.

The Open WebUI session token is stored in localStorage, so an attacker-controlled preview page can exfiltrate it directly to an external collector. Once the token is stolen, the attacker impersonates the victim through the REST API. If the compromised account has administrator privileges or the workspace.functions permission, the attacker can register Python functions that Open WebUI executes server-side, converting the XSS into remote code execution on the host.

Root Cause

The root cause is an over-permissive iframe sandbox attribute in src/lib/components/chat/FileNav/FilePreview.svelte. Coupling allow-scripts with allow-same-origin for same-origin HTML content voids the sandbox protection. User-supplied HTML executed with the privileges of the application origin.

Attack Vector

The attack requires low-privileged authentication and access to a configured terminal server. The attacker uploads an HTML payload to a path served by the terminal, then convinces a higher-privileged user to open the preview. No additional user interaction beyond viewing the preview is required.

text

 			{/if}
 			<iframe
 				src={serveUrl}
-				sandbox="allow-scripts allow-same-origin allow-downloads{($settings?.iframeSandboxAllowForms ??
-				false)
+				sandbox="allow-scripts allow-downloads{($settings?.iframeSandboxAllowForms ?? false)
 					? ' allow-forms'
-					: ''}"
+					: ''}{($settings?.iframeSandboxAllowSameOrigin ?? false) ? ' allow-same-origin' : ''}"
 				class="w-full h-full border-none bg-white"
 				title="HTML Preview"
 			/>

Source: Open WebUI commit 65a5fad. The patch removes the unconditional allow-same-origin flag and gates it behind an explicit iframeSandboxAllowSameOrigin setting that defaults to false.

Detection Methods for CVE-2026-70486

Indicators of Compromise

Uploads of HTML files to terminal-served directories by non-admin users, particularly files containing <script> tags referencing localStorage.token.
Outbound HTTP requests from browser sessions to unexpected domains carrying Authorization: Bearer values matching the Open WebUI token format.
Newly registered Open WebUI functions or tools created immediately after an admin previewed a file.
Session activity from a single account across multiple, geographically inconsistent source IPs within a short window.

Detection Strategies

Inspect Open WebUI application logs for FilePreview iframe loads that reference user-uploaded HTML paths.
Alert on browser DOM events accessing window.localStorage from iframe contexts on the Open WebUI origin.
Correlate function/tool creation API calls (POST /api/v1/functions/create) with recent file-preview activity on admin sessions.

Monitoring Recommendations

Enable web server access logging for the terminal file-preview endpoint and forward events to a centralized SIEM for retention and correlation.
Monitor egress traffic from client workstations that interact with Open WebUI for anomalous POST bodies containing bearer tokens.
Track Open WebUI version strings across deployments to identify hosts still running vulnerable releases between 0.9.0 and 0.11.0.

How to Mitigate CVE-2026-70486

Immediate Actions Required

Upgrade Open WebUI to version 0.11.0 or later on every deployment.
Rotate all Open WebUI session tokens and API keys after upgrade to invalidate any credentials that may have been exfiltrated.
Audit user-uploaded files in terminal-served directories and remove any HTML content submitted by non-trusted accounts.
Review recently created functions, tools, and workspace configurations for entries that were not authorized.

Patch Information

The fix is available in Open WebUI v0.11.0 via Pull Request #26907 and commit 65a5fad7. Details are published in GHSA-3xpf-xq7r-v8c5. The patch removes the default allow-same-origin flag from the preview iframe and gates it behind an opt-in setting.

Workarounds

Disable the terminal server integration until the upgrade to 0.11.0 is complete.
Restrict workspace.functions and admin roles to a minimal set of trusted operators to reduce blast radius.
Enforce a Content Security Policy that blocks inline script execution and restricts connect-src to trusted domains.
Leave the iframeSandboxAllowSameOrigin setting disabled after upgrade unless a specific integration requires it.

bash

# Upgrade Open WebUI via Docker to the patched release
docker pull ghcr.io/open-webui/open-webui:0.11.0
docker stop open-webui && docker rm open-webui
docker run -d -p 3000:8080 \
  -v open-webui:/app/backend/data \
  --name open-webui --restart always \
  ghcr.io/open-webui/open-webui:0.11.0

# Verify iframeSandboxAllowSameOrigin remains disabled in the admin settings