OPEN-WEBUI · GHSA-3vvh-g22g-jq6r · AI agents & MCP
FIX → 0.12.2
Open WebUI stored client-supplied message metadata without checking it, so a channel member can post a message that displays under a channel webhook's name and role. An attacker can use this to deceive other channel members, such as those who trust an alerting or ops bot, but cannot read new data or use the webhook's token.
first public Oct 18, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only Open WebUI instances with channels enabled (ENABLE_CHANNELS is false by default) and at least one channel webhook are exposed. The attacker must be a channel member with write access who knows the webhook id, which any member can read from a message the webhook posted. Instances with channels disabled or without channel webhooks are not affected.
Not affected if channels-disabled, no-channel-webhooks, version-0.12.2-or-later
Who cares channels, open-webui, python, self-hosted, webhooks
ENABLE_CHANNELS is set to true on the instance.pip show open-webui; versions from 0.7.0 up to but not including 0.12.2 are affected.Any member who can post in a channel can make their message appear as if a real webhook of that channel posted it. The server stored the metadata the client sent with a message without checking it. The channel then showed the message under the webhook's name and role, with no webhook token required.
Channels are enabled (ENABLE_CHANNELS, default False). The channel has at least one webhook. The attacker is a member with write access to the channel. The attacker knows the webhook's id. Any member can read it from a message the webhook posted, so it is not a secret. Instances with channels disabled, or without channel webhooks, are not affected.
A member can post, edit and pin messages that other members see as coming from a trusted webhook, such as an alerting or ops bot. That makes social engineering inside the channel easy. The stored author is still the attacker's account. The attacker cannot change the webhook's real messages, read anything new or act with the webhook's token.
Fixed in #32421. The server now drops any message metadata sent by the client, both when a message is posted and when it is edited, so only the server sets it. Upgrading is enough.
Component: the channel message post and edit endpoints in backend/open_webui/routers/channels.py. Affected setup: every build with channel webhooks, from 0.7.0. The message form accepted an arbitrary metadata object from the client and stored it as is. The message list and the pinned list then trusted that metadata to decide who the message was from. A webhook id in the metadata was enough for the message to be shown as that webhook.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 0.12.2
open-webui 0.12.2 (fixed in #32421; the server now drops client-sent message metadata on post and edit, and upgrading is enough).meta.webhook = {"id": "<webhook id>", "name": "Ops Bot"} and pins it.Ops Bot with role webhook, while the stored author is Alice.Run by the reporter on 0.11.3.
@Tarekinh0 (reporter)