A HIGH-severity vulnerability identified as CVE-2026-26193 has been published on February 19, 2026 with a CVSS base score of 7.3. The vulnerability affects Openwebui Open webui. This security advisory provides a detailed breakdown of the vulnerability, its potential impact, weakness classification, and actionable steps to protect your systems.
Vulnerability Details
CVE ID: CVE-2026-26193
Severity: HIGH
CVSS Score: 7.3
Published: February 19, 2026
Affected Product: Openwebui Open webui
Weakness (CWE): CWE-79
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | Low |
| User Interaction | Required |
| Confidentiality Impact | High |
| Integrity Impact | High |
| Availability Impact | None |
Technical Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.44, aanually modifying chat history allows setting the `embeds` property on a response message, the content of which is loaded into an iFrame with a sandbox that has `allow-scripts` and `allow-same-origin` set, ignoring the "iframe Sandbox Allow Same Origin" configuration. This enables stored XSS on the affected chat. This also triggers when the chat is in the shared format. The result is a shareable link containing the payload that can be distributed to any other users on the instance. Version 0.6.44 fixes the issue.
Potential Impact
If exploited, this high-severity vulnerability could allow an attacker to compromise sensitive data confidentiality, tamper with system integrity. Organizations running Openwebui Open webui should treat this as a priority remediation item.
Recommended Action
A patch or vendor advisory is available. Take the following steps immediately:
- Review the vendor advisory linked in the References section below.
- Identify all instances of the affected software in your environment.
- Apply the available patch or upgrade to the fixed version as soon as possible.
- If patching is not immediately possible, implement compensating controls such as WAF rules, network segmentation, or disabling the affected feature.
- Monitor your systems for signs of exploitation using your SIEM or IDS/IPS.
References
Related Security Advisories
- [HIGH] CVE-2026-26192 — CVSS 7.3 — HIGH / CVSS 7.3
- [HIGH] CVE-2026-27464 — CVSS 7.7 (February 21, 2026) — HIGH / CVSS 7.7
- [HIGH] CVE-2026-27466 — CVSS 7.2 (February 21, 2026) — HIGH / CVSS 7.2
![[CRITICAL] CVE-2026-28773 — CVSS 9.3 (March 4, 2026)](https://atlas-cybersecurity.com/wp-content/plugins/elementor/assets/images/placeholder.png)
