The self-hosted chat frontend is this morning's headline. Open WebUI — the UI a large share of this audience points at a local Ollama or vLLM box — takes eighteen CVEs indexed at once, led by two 7.7 highs: a low-privilege account running code and tools inside another user's session, and realtime endpoints that keep accepting JWTs after signout. Every one of them closes in 0.10.0. Underneath, two AWS agent packages patch highs — bedrock-agentcore 1.18.1 and the AWS API MCP Server 1.3.47 — and on the .NET side Kiota carries a 9.3 critical.

Worth your morning

Open WebUI — eighteen at once, one version to move to. The batch spans access control, session handling, and data exposure. Read three first. CVE-2026-59216 (7.7) lets a low-privilege user run code and tool calls inside another user's authenticated session; if that user is an admin, the advisory puts the result at code execution as the server process, which in the default container is root. CVE-2026-59219 (high) has realtime endpoints accepting tokens the server already revoked at signout — a logout that logs you out of everything except the socket. CVE-2026-59221 (7.7) is a terminal-proxy path guard that decodes its input eight times against an input encoded nine. The rest — channel-member responses carrying credential fields, cross-user model-list exposure, knowledge-base write checks skipped on upload, a filter list bypassable by URL path — are moderates and lows, and they close in the same release. 0.10.0, today, and if your instance is reachable from anything but localhost, treat that as the priority ordering.

The two AWS agent packages. CVE-2026-16796 (8.4) is in bedrock-agentcore: install_packages() doesn't neutralize argument delimiters, so a package specifier reaching it from model output can run commands inside the Code Interpreter sandbox. Fixed in 1.18.1 — and the advisory's own guidance is the durable version: don't hand model-generated strings to that method, patched or not. CVE-2026-16584 (7.3) hits the AWS API MCP Server, where a startup failure in policy initialization leaves the per-request security check bypassed for the life of the process — the deny and gate rules you configured stop being consulted, silently, and IAM on the credentials is all that's left holding the line. Second fail-open in three days, after Auth.js on Thursday. Fixed in 1.3.47.

Kiota — the critical on the .NET side. CVE-2026-59865 (9.3) and CVE-2026-59864 (9.3) both come down to the same premise: Kiota treats an OpenAPI description as trusted input. One reaches command execution via a suggested dependency-install command carried in a spec extension — worse under the VS Code extension, which can run it without a prompt. The other writes attacker-chosen file paths into generated Copilot plugin manifests, which then travel to M365 Copilot or Teams. A file-write and code-injection high (CVE-2026-59866) plus generator-injection and SSRF issues ride along. All fixed in 1.32.5; 1.34.0 also clears a later path-traversal moderate, so make that the target. If you generate API clients from specs you didn't write, this is today's upgrade.

Also worth a npm ls: brace-expansion CVE-2026-14257 (7.5) crashes a Node process on roughly 7.5 KB of crafted input, and the out-of-memory error is fatal rather than catchable — it sits under minimatch and glob, so it's in almost every tree. 5.0.8 bounds the expansion. Quiet elsewhere: nothing new has cleared the bar on Angular, PrimeNG, .NET runtime, or Azure since July's servicing release on the 14th.