AI Threat Alert
CVE-2024-7053: open-webui: XSS enables admin session hijack via chat
GHSA-43g4-487m-5q6m HIGH CISA: TRACK*Any user-level account on open-webui ≤0.3.8 can steal an admin's session cookie by embedding a malicious markdown image in a chat message—admin only needs to open the conversation. This results in full account takeover and potential RCE on the LLM host. Upgrade immediately, enforce HTTPS-only deployment, and restrict access to trusted users until patched.
What is the risk?
High practical risk for organizations self-hosting open-webui with mixed trust levels (e.g., multiple team members or trial users). The attack requires only a legitimate user account and a single admin view event—no AI/ML expertise needed, making it trivially executable by any malicious insider or compromised user account. EPSS is low (0.00168) suggesting no mass exploitation observed yet, but open-webui has millions of deployments, and the admin-to-RCE escalation path elevates severity significantly beyond the CVSS score alone.
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Open WebUI | pip | <= 0.3.8 | No patch |
Do you use Open WebUI? You're affected.
How severe is it?
What is the attack surface?
What should I do?
6 steps-
UPGRADE
Check open-webui GitHub releases for a patched version beyond 0.3.8 and update immediately.
-
ENFORCE HTTPS
Serve open-webui exclusively over HTTPS—this prevents the SameSite=Lax bypass by blocking cleartext cookie transmission to cross-origin HTTP endpoints.
-
INJECT SECURE FLAG
As an immediate workaround via reverse proxy (nginx:
proxy_cookie_flags ~ secure;/ Caddy: header +Set-Cookie Secure), add the Secure attribute to all session cookies if application cannot be patched. -
RESTRICT ACCESS
Do not expose open-webui to the internet without strong perimeter authentication (SSO/VPN); limit to trusted internal users only.
-
AUDIT SESSIONS
Review admin account login history for unexpected source IPs or concurrent sessions.
-
DETECT
Monitor outbound HTTP requests from the open-webui host for external image/resource loads from chat-rendered content; alert on admin sessions from IPs not matching known admin workstations.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2024-7053?
Any user-level account on open-webui ≤0.3.8 can steal an admin's session cookie by embedding a malicious markdown image in a chat message—admin only needs to open the conversation. This results in full account takeover and potential RCE on the LLM host. Upgrade immediately, enforce HTTPS-only deployment, and restrict access to trusted users until patched.
Is CVE-2024-7053 actively exploited?
No confirmed active exploitation of CVE-2024-7053 has been reported, but organizations should still patch proactively.
How to fix CVE-2024-7053?
1. UPGRADE: Check open-webui GitHub releases for a patched version beyond 0.3.8 and update immediately. 2. ENFORCE HTTPS: Serve open-webui exclusively over HTTPS—this prevents the SameSite=Lax bypass by blocking cleartext cookie transmission to cross-origin HTTP endpoints. 3. INJECT SECURE FLAG: As an immediate workaround via reverse proxy (nginx: `proxy_cookie_flags ~ secure;` / Caddy: header +Set-Cookie Secure), add the Secure attribute to all session cookies if application cannot be patched. 4. RESTRICT ACCESS: Do not expose open-webui to the internet without strong perimeter authentication (SSO/VPN); limit to trusted internal users only. 5. AUDIT SESSIONS: Review admin account login history for unexpected source IPs or concurrent sessions. 6. DETECT: Monitor outbound HTTP requests from the open-webui host for external image/resource loads from chat-rendered content; alert on admin sessions from IPs not matching known admin workstations.
What systems are affected by CVE-2024-7053?
This vulnerability affects the following AI/ML architecture patterns: LLM chat interfaces, self-hosted AI assistants, ML UI platforms, open-source LLM deployments.
What is the CVSS score for CVE-2024-7053?
CVE-2024-7053 has a CVSS v3.1 base score of 7.6 (HIGH). The EPSS exploitation probability is 0.66%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0011 User Execution AML.T0012 Valid Accounts AML.T0025 Exfiltration via Cyber Means AML.T0049 Exploit Public-Facing Application AML.T0080.001 Thread AML.T0091.000 Application Access Token Compliance Controls Affected
What are the technical details?
Original Advisory
A vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default `SameSite=Lax` and does not have the `Secure` flag enabled, allowing the session cookie to be sent over HTTP to a cross-origin domain. An attacker can exploit this by embedding a malicious markdown image in a chat, which, when viewed by an administrator, sends the admin's session cookie to the attacker's server. This can lead to a stealthy administrator account takeover, potentially resulting in remote code execution (RCE) due to the elevated privileges of administrator accounts.
Exploitation Scenario
An attacker creates or compromises a standard user account on the target open-webui instance. They send a chat message to a shared channel or directly to a conversation visible to an admin, embedding a markdown image tag pointing to an attacker-controlled HTTP server (e.g., ``). Because open-webui session cookies lack the Secure flag and use SameSite=Lax, when the administrator opens the chat in their browser, the browser issues a cross-origin GET request and attaches the admin's session cookie. The attacker captures the cookie from their server logs, replays it in their own browser, and now has full admin access to the open-webui instance—accessing all user conversations, stored API keys for backend LLMs, and system configuration. With admin privileges the attacker may install malicious tools or plugins, exfiltrate the entire conversation history, or pivot to RCE on the underlying host.
Weaknesses (CWE)
CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
- [Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N References
Timeline
Related Vulnerabilities
CVE-2026-44551 9.1 open-webui: LDAP auth bypass — full account takeover
Same package: open-webui CVE-2026-45672 8.8 open-webui: code exec gate bypass via API endpoint
Same package: open-webui CVE-2026-44552 8.7 open-webui: Redis cache poisoning enables cross-instance tool hijack
Same package: open-webui CVE-2025-64495 8.7 Open WebUI: XSS-to-RCE via malicious prompt injection
Same package: open-webui CVE-2026-45315 8.7 open-webui: stored XSS → JWT theft and admin takeover
Same package: open-webui