Detections
Analytics
SCA: security update for open-webui (GHSA-73x5-h92w-xc2j)
low Tenable Self-Hosted Container Security Plugin ID 445229
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0,
channel thread parent and reply handling did not bind parent_id to the channel in the URL, allowing an
authenticated user to reference a message from another private or DM channel and disclose thread context
across channels. This issue is fixed in version 0.10.0. (CVE-2026-59215)
Solution
Update the open-webui library and its related packages to version 0.10.0 or later.See Also
Plugin Details
Severity: Low
ID: 445229
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 7/24/2026
Updated: 7/24/2026
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Low
Base Score: 2.1
Temporal Score: 1.6
Vector: CVSS2#AV:N/AC:H/Au:S/C:P/I:N/A:N
CVSS Score Source: CVE-2026-59215
CVSS v3
Risk Factor: Low
Base Score: 3.1
Temporal Score: 2.7
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 7/24/2026
Vulnerability Publication Date: 7/9/2026
Reference Information
CVE: CVE-2026-59215
cwe: CWE-639