CVE-2026-54007: Open WebUI Cross-Origin Message Injection

Technical summary

Open WebUI's chat message listener fails to validate the origin of input:prompt and action:submit postMessage events. This violates same-origin policy enforcement for cross-window communication. An attacker-controlled page can post these messages to a victim's Open WebUI window, causing the client-side submitPrompt() function to execute with attacker-supplied text. This triggers unauthorized HTTP POST requests to /api/v1/chats/new and /api/chat/completions endpoints, sending arbitrary prompts to the LLM backend as if the victim had typed them. The vulnerability maps to CWE-346 (Origin Validation Error) and requires an authenticated session but no additional user interaction beyond visiting a malicious site.

Business impact

Organizations using Open WebUI for internal AI tasks face exposure of sensitive model interactions and unintended consumption of API credits or model inference resources. An attacker could craft prompts designed to extract training data, manipulate decision outputs, or probe internal tool behavior. Because the victim's authentication is leveraged, audit logs will incorrectly attribute malicious queries to legitimate users, complicating incident investigation and compliance reporting. For teams using Open WebUI with access to internal knowledge bases or proprietary tools, this expands the attack surface to include unauthorized data exfiltration and tool misuse.

Affected systems

Open WebUI versions 0.9.5 and earlier are affected. The vulnerability is resolved in version 0.9.6. Self-hosted Open WebUI deployments are at risk if users with active sessions visit untrusted websites or receive emails/messages directing them to attacker-controlled pages. Cloud or multi-tenant instances are similarly vulnerable if users access the web interface from shared networks or less-trusted browsing contexts.

Exploitability

Exploitability is straightforward: an attacker needs only to host a page with JavaScript that posts forged messages to the Open WebUI origin and wait for an authenticated user to visit. No special network access, complex gadget chains, or out-of-band delivery is required. The attack succeeds silently and is difficult for users to detect in real-time. However, the prerequisite of an authenticated session and reliance on user browsing behavior (visiting an attacker's page) keeps severity below 'critical.' CVSS score 6.5 (Medium) reflects the high integrity impact (unauthorized actions) offset by the need for prior authentication and limited confidentiality/availability impact.

Remediation

Upgrade Open WebUI to version 0.9.6 or later immediately. This patch implements origin validation for postMessage listeners, blocking cross-origin input:prompt and action:submit events. Organizations should verify the upgrade in a non-production environment first to confirm compatibility with local customizations or integrations. No configuration changes are required post-upgrade.

Patch guidance

Deploy Open WebUI 0.9.6 as soon as feasible. Review your deployment pipeline to enable automated security updates for patch releases. If automated updates are not feasible, prioritize this upgrade within your regular patching cycle. Verify that custom extensions or integrations—if any—continue to function after the upgrade by testing chat message submission and API calls in your standard workflow.

Detection guidance

Monitor for suspicious postMessage activity in browser developer tools or network logs: look for POST requests to /api/v1/chats/new or /api/chat/completions that originate from unexpected user sessions or contain unusual prompts that do not match user behavior patterns. Review Open WebUI access logs for unusual query volumes, unexpected tool or model invocations, or queries attributed to users during periods when they were not actively using the platform. Implement Content Security Policy (CSP) headers on your Open WebUI deployment to restrict postMessage communication to same-origin contexts only, as an additional preventive control.

Why prioritize this

Although CVSS scores this as Medium (6.5), the attack's ease of execution and potential for silent unauthorized action warrant prioritization. The vulnerability enables forced execution of AI queries under victim identity, risking data leakage, compliance violations, and resource abuse. The fix is straightforward and low-risk, making immediate patching practical. Organizations handling sensitive data or running Open WebUI with access to internal tools should treat this as high-priority.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects: (1) Network-based attack vector requiring no special privileges; (2) Low attack complexity—no special conditions beyond authenticated session and user browsing; (3) High integrity impact—attacker can force unauthorized actions and state changes; (4) No confidentiality or availability impact—the attacker cannot read data directly or degrade service. The Medium severity is appropriate because exploitation requires a prior authenticated session, limiting the pool of vulnerable targets. However, the integrity impact is significant enough to warrant prompt remediation.

Frequently asked questions