{
 "id": "AIR-2026-0044",
 "slug": "cve-2026-70486-open-webui-file-preview-iframe-vulnerability",
 "title": "CVE-2026-70486: Open WebUI file-preview iframe vulnerability leads to account takeover",
 "summary": "An iframe permission flaw in Open WebUI enables authenticated users to execute scripts in the application origin and steal session tokens. The vulnerability is addressed through software patches without confirmed exploitation.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Open WebUI"
 ],
 "incident_date": "2026-08-04",
 "incident_date_precision": "day",
 "first_reported": "2026-08-04",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70486",
   "publisher": "NVD",
   "title": "CVE-2026-70486: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.",
   "published_at": "2026-08-04"
  },
  {
   "url": "https://github.com/advisories/GHSA-3xpf-xq7r-v8c5",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-70486: Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin",
   "published_at": "2026-08-04"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-70486",
  "xss",
  "account_takeover"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T07:00:14.101Z"
}