A HIGH-severity vulnerability identified as CVE-2026-26192 has been published on February 19, 2026 with a CVSS base score of 7.3. The vulnerability affects Openwebui Open webui. This security advisory provides a detailed breakdown of the vulnerability, its potential impact, weakness classification, and actionable steps to protect your systems.
Vulnerability Details
CVE ID: CVE-2026-26192
Severity: HIGH
CVSS Score: 7.3
Published: February 19, 2026
Affected Product: Openwebui Open webui
Weakness (CWE): CWE-79
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | Low |
| User Interaction | Required |
| Confidentiality Impact | High |
| Integrity Impact | High |
| Availability Impact | None |
Technical Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.7.0, aanually modifying chat history allows setting the `html` property within document metadata. This causes the frontend to enter a code path that treats document contents as HTML, and render them in an iFrame when the citation is previewed. This allows stored XSS via a weaponized document payload in a chat. The payload also executes when the citation is viewed on a shared chat. Version 0.7.0 fixes the issue.
Potential Impact
If exploited, this high-severity vulnerability could allow an attacker to compromise sensitive data confidentiality, tamper with system integrity. Organizations running Openwebui Open webui should treat this as a priority remediation item.
Recommended Action
A patch or vendor advisory is available. Take the following steps immediately:
- Review the vendor advisory linked in the References section below.
- Identify all instances of the affected software in your environment.
- Apply the available patch or upgrade to the fixed version as soon as possible.
- If patching is not immediately possible, implement compensating controls such as WAF rules, network segmentation, or disabling the affected feature.
- Monitor your systems for signs of exploitation using your SIEM or IDS/IPS.
References
Related Security Advisories
- [HIGH] CVE-2026-26193 — CVSS 7.3 — HIGH / CVSS 7.3
- [HIGH] CVE-2026-27464 — CVSS 7.7 (February 21, 2026) — HIGH / CVSS 7.7
- [HIGH] CVE-2026-27466 — CVSS 7.2 (February 21, 2026) — HIGH / CVSS 7.2
![[CRITICAL] CVE-2026-28773 — CVSS 9.3 (March 4, 2026)](https://atlas-cybersecurity.com/wp-content/plugins/elementor/assets/images/placeholder.png)
