Sixteen CVEs against the self-hosted AI platform Open WebUI landed in NVD within one hour on September 9, 2026, all fixed by version 0.11.1 — a release that shipped 15 days earlier and told administrators in its own notes that some of its security fixes were being withheld.
What happened
Between 4:17 p.m. and 5:18 p.m. Central on Wednesday, September 9, 2026, sixteen CVE records were published against Open WebUI, the self-hosted platform that puts a browser front end on local and hosted language models. Every one of them was assigned by the GitHub Security Advisory CNA, every one carries a CVSS v3.1 score from the same source, and every one names the same fixed version: 0.11.1.
PyPI dates the 0.11.1 upload to August 25, 2026. The batch therefore describes flaws that were closed 15 days before anyone outside the project could read what they were.
The project said as much at the time. The v0.11.1 release notes carry this line: “This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade.”
Two of the sixteen are scored High and above 8. The higher, CVE-2026-87995 at 8.7, is in the terminal port preview: the record states that src/lib/components/chat/FileNav/PortPreview.svelte “rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin.” Those two sandbox tokens together are the documented way to get no sandbox at all — the framed content can script, and it scripts in the parent’s origin. An authenticated user with terminal server access could host script on a previewed port and take over the account of anyone who opened the preview. Affected from 0.8.11.
The other, CVE-2026-87016 at 8.1, is the more interesting record, and it is the reason this batch is worth reading rather than skimming. The description reads: “From 0.6.41 until 0.11.1, get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject containing percent or underscore wildcard characters could resolve to a different stored identity, potentially selecting an administrator account and issuing the attacker that account’s session; PostgreSQL deployments were not affected.”
The vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — network, no privileges, no user interaction, high attack complexity. The CWEs are CWE-155, improper neutralization of wildcards, and CWE-287, improper authentication. Both functions look up a user by the identifier an identity provider hands back. On SQLite the ORM’s JSON containment lowered to LIKE, and in LIKE, % matches any run of characters and _ matches any single one. A subject value carrying either can match a row it does not name.
The remaining fourteen cluster into shapes. Three are server-side request forgery through different gaps in the same URL-fetch guard: CVE-2026-87996 at 7.7, a time-of-check to time-of-use gap between DNS validation and the request; CVE-2026-87999 at 7.1, reserved and Azure platform ranges not caught by the routing classification; and CVE-2026-88001 at 5.0, HTTP redirects escaping the private-address check after it had already passed. Three more are unbounded loops from cycles the data model permits: CVE-2026-87013 in folder tree traversal, CVE-2026-88000 in message deletion, and CVE-2026-88002 in message-chain reconstruction, which reaches back to 0.5.0 and is the oldest range in the batch.
The rest are authorization gaps: a demoted administrator keeping cached permissions on a Socket.IO connection (CVE-2026-87014, 6.5), knowledge-base metadata filters not applied in the vector backend (CVE-2026-87017, 4.3), chat completions not checking who wrote a message before replacing it (CVE-2026-87994, 4.3), chat creation skipping folder write-access validation (CVE-2026-87997, 4.3), a non-admin deleting a shared external connection out from under other people’s knowledge bases (CVE-2026-87998, 7.1), and session cookies shared across external tool servers through one connection cookie jar (CVE-2026-87015, 6.8). Two are availability: an unauthenticated logout handler doing blocking network work (CVE-2026-87011, 7.5) and an unvalidated calendar alert value stopping the reminder scheduler for everyone (CVE-2026-87012, 4.3).
Version 0.11.3, uploaded August 31, 2026, is current. No record in the batch carries a KEV entry, a federal deadline, or any statement of exploitation.
Why it matters
Start with the SQLite line, because it is the one that changes what a reader should go check. Open WebUI’s default deployment stores data in SQLite; PostgreSQL is what a team moves to when the install grows. So the authentication bypass here does not fall on the hardened, scaled-up installs. It falls on the ones that were stood up with the default and left alone — a container someone ran to try a local model, which then quietly became the place a team’s chats live. The record says PostgreSQL was not affected, which means the same application code, the same identity provider, and the same OAuth subject produce a different security outcome depending on a storage choice made for unrelated reasons.
That is worth generalizing carefully. The flaw is not in the authentication logic as written; it is in what the ORM’s JSON containment lowered to on one backend. An expression that means “this field contains this value” became “this field is like this pattern,” and a pattern language has metacharacters. Anywhere an identity lookup is expressed at a level of abstraction above SQL, the question of what it compiles to on each supported backend is a security question, and it is one that a code review of the authentication path will not surface.
The other thing this batch shows is the shape of a coordinated cleanup. Sixteen records, one hour, one fixed version, and clusters that read as a systematic sweep rather than sixteen independent reports: three ways past one SSRF guard, three unguarded traversals of cyclic structures, six authorization checks in the wrong place. Someone went looking category by category, and the project shipped the answers together.
Which brings up the 15-day gap, and here Open WebUI deserves more credit than it might first appear. It said in the release notes that fixes were being withheld and told administrators to upgrade anyway. That is a disclosed embargo — an operator reading the notes on August 25 had the information needed to treat 0.11.1 as a security release even without the details. Compare it with the AWS Postgres MCP server disclosure published earlier today, where a single release carried two security fixes disclosed 71 and 76 days later with no notice at the time that anything was pending. Both left operators deciding on an upgrade without knowing its severity. Only one of them said so.
The honest limit on that credit is the phrasing. “May be withheld for a short time” does not say how many, how bad, or how short, and the sentence appears under a heading in a release note enumerating roughly 170 changes. An administrator who parses it correctly still cannot weigh it against a change freeze.
What to do
Upgrade to 0.11.3, or at minimum 0.11.1, which is the fixed version every record in the batch names.
If you cannot upgrade immediately and your deployment uses SQLite with OAuth or SCIM, treat CVE-2026-87016 as the one to act on first. It needs no credentials and no user interaction. The practical check is whether your identity provider’s subject values can contain % or _, and whether anyone other than your own directory can influence what those values are — a provider allowing self-registration or an attacker-chosen external ID is the case that matters. Review administrator accounts and active sessions for logins that do not match a person.
For CVE-2026-87995, the exposure requires terminal server access, so it is bounded by who has that. If the terminal feature is not in use, disable it rather than relying on the preview being unopened.
For the three SSRF records, the durable control is network egress from the Open WebUI container, not the application’s own address checks — which failed here in three separate ways. Block the link-local metadata address and internal ranges at the network layer.
Sourcing note
All sixteen CVE records were read from the NVD API at services.nvd.nist.gov, which supplied the descriptions quoted above, the CVSS v3.1 vectors and scores, the scoring source, the CWE assignments, affected version ranges, publication timestamps, and reference URLs. Each record cites the project’s own GitHub Security Advisory, a fixing commit, and the v0.11.1 release tag. The release-note quotation is from the v0.11.1 release page at github.com.
Release dates are from the PyPI JSON API rather than GitHub, because GitHub renders release dates without the year in the listing view; PyPI’s upload_time gives 0.11.1 as August 25, 2026 and 0.11.3 as August 31, 2026.
Unresolved: the individual GHSA advisory pages were not read this run, so any proof-of-concept detail, credit, or workaround they carry beyond the CVE text is not reflected here. The project does not say how many of the sixteen were the withheld fixes it referred to on August 25, or whether any were reported by an outside researcher. No exploitation of any record in this batch has been reported by any party we checked, and none carries a CISA KEV entry or a federal remediation deadline.