Business & Enterprise Operations Top 100 / #52ARD = Agentic Resource Discovery · A2A = Agent2Agent · MCP = Model Context Protocol

Local AI/agent workspace · BSD-3-Clause · GitHub; self-hosted

Open WebUI

Very large self-hosted AI interface with tools/functions and agent workflows. Publisher: Open WebUI. Also ranked in Technology & Software Engineering (#53), Sales, Marketing & Customer Experience (#84), Supply Chain, Manufacturing & Logistics (#86).

Vendor page ↗+ CompareExport JSON

Trust profileas of 2026-10-26

Publisherlikely · Repository ownership or inferred publisher domain — repository or Hub account ownershiplikely

Complianceno evidence foundT5

Security165 CVEs linked in the registry · 71 critical/high · newest 2026-10-12linked

ProtocolsModel Context Protocol (MCP) claimed — named in the resource's own tags; no endpoint at the publisher's well-known paths sourceAgent2Agent (A2A) probed, not foundAgentic Resource Discovery (ARD) probed, not found1 / 3

TracesNone found — nobody has published what this agent does under attacknone

Issues found0 regulator actions · 0 incidents · 0 withdrawn certificates · CVEs: see Securitylinks only

Evidence available — not a safety certification. Suitability depends on your task, deployment and permissions. Rows marked vendor-level describe Open WebUI, not this agent specifically.

Traces — under attack, in defence, in incidents

none public · what a trace is

No public trace found. Nobody has published what Open WebUI does when its inputs carry instructions it should not follow, when a tool asks for credentials, or when a task invites a destructive command. Defenders can't learn from what they can't see: run it in a sandbox before the pilot and keep the transcript, or ask the vendor to publish one.

● third-party or vendor report · ◎ this registry's own probe transcript · ⚠ data left the environment. A trace describes one version on one date; it is evidence of behaviour, never a certification. Rows marked unreviewed have not yet been checked against their source by the maintainer.

CVEs — on the official record

165 linked · the registry

CVE-2026-109283

2026-10-12

Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and…

Credential access · Auth bypass · unreviewed

Medium 5.3

CVE-2026-109284

2026-10-12

Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat's folder without check…

Auth bypass · unreviewed

Medium 5.3

CVE-2026-109285

2026-10-12

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base collaborators keep file access via stal…

Auth bypass · unreviewed

Low 2.3

CVE-2026-109286

2026-10-12

Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by p…

— · unreviewed

High 8.6

CVE-2026-109287

2026-10-12

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested know…

Auth bypass · unreviewed

Medium 5.3

CVE-2026-109288

2026-10-12

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating…

— · unreviewed

High 7.2

CVE-2026-109289

2026-10-12

Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through an already open term…

Auth bypass · unreviewed

Medium 5.3

CVE-2026-109290

2026-10-12

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading craf…

— · unreviewed

High 8.4

157 more · All 165 in the registry → Severity is the official record's; nothing here enters the score. Links are by listed product, so a CVE that names a different component of the same platform may be missing.

Compliance evidence

4 frameworks shown

–

SOC 2

T5 Unknown

Nothing found in the sources checked.

Scope: — · registries, marketplaces, vendor pages

ask the vendor

–

ISO 27001

T5 Unknown

Nothing found in the sources checked.

Scope: — · registries, marketplaces, vendor pages

ask the vendor

–

ISO 42001

T5 Unknown

Nothing found in the sources checked.

Scope: — · registries, marketplaces, vendor pages

ask the vendor

–

CSA STAR

T5 Unknown

Nothing found in the sources checked.

Scope: — · CSA STAR Registry

ask the vendor

"Unknown" means nothing was found in the sources checked — registries, marketplaces and the vendor's own pages. It is not a finding of non-compliance; ask the vendor.

✔ found · ○ claimed · – not found · ⚠ expired, stale or revoked. Every row links to its source.Dispute or correct this dossier

GDPR, assembled from checks

GDPR● 0 found in registries or documents○ 0 vendor-claimed⚠ 0 issues linkedas of 2026-10-26

– Not foundNo Article 42 GDPR seal. "GDPR certified" is never shown without one.

☐ You checkYour lawful basis, DPIA, and whether this agent is inside the certificate scope.

News and chatter

last 90 days · linked with confidence ≥ 0.85

2026-10-25

open-webui release v0.12.4

GitHub releases · ### Added - 🎯 **Load selected skills on demand.** Administrators can turn on "Load selected skills on demand" under Admin Settings > General or set "ENABLE_SKILL_LAZY_LOADING", so skills selected in the chat or attached to a model are onl

Product update

2026-10-16

open-webui release v0.12.3

GitHub releases · ### Added - 🔐 **End-to-end encrypted chats.** Direct messages and private group channels can now hold a temporary end-to-end encrypted chat: a member picks Encrypted Chat in the channel menu, the other members see "Encrypted chat in progr

Product update

Headline, link and a summary attributed to the outlet. News never changes trust or domain scores.

Business & Enterprise Operations score

general profile · sar-score-2.0 · #52 of 100 in the curated list

Adoption / usage28 / 30

Trust & security17 / 25

Project / product health20 / 20

Ecosystem / interoperability14 / 15

Domain expertise / fit100 / 100

Governance / compliance evidenceunknown

Docs / transparency9 / 10

Raw component / maximum, then weighted by the general profile (adoption 25, trust 20, project 15, ecosystem 10, domain 10, governance 5, docs 5). Trust and governance are computed from the evidence on this page (vendor-level rows at half credit); the other components come from the curated workbook, whose order is the rank. Unknown components count as 0 and are never imputed.

Before you deploy

Derived from the evidence ledger. This agent is not yet in the reference set, so deployment questions (credentials, approval, data handling) are not answered here — ask the vendor.

Evidence supporting this use (0)

Nothing found in the sources checked.

Unknowns to check (2)

Your lawful basis and DPIA for the personal data the agent will process

Ask the vendor for SOC 2, ISO 27001, ISO 42001, CSA STAR evidence; none was found in the sources checked

Suggested restrictions for a pilot (2)

Ask for the SOC 2 report under NDA before the pilot touches customer data; none was found in the sources checked.

No public trace of this agent under adversarial input was found. Run it in a sandbox against your own prompt-injection and tool-abuse scenarios before the pilot, and keep the transcript; the enterprise edition records one.

Rules: config/deploy_rules.json. Advice for a bounded pilot, not a verdict.

Provenance

seed workbookscores, rank, category

NVDsecurity (CVE keyword search)

Hacker News, GDELT, vendor feedsnews and chatter

First seen2026-10-26

Recordres_0212992ec8356ec3

Open the full record (JSON) →