The reviewed npm and pip databases have published nothing since Thursday, so this morning comes from repository advisories and the unreviewed feed. Open WebUI is the whole story: seventeen advisories between August 29 and September 4, topping out at 8.7, all closed by 0.11.1 — and all of them affecting 0.11.0, which is the floor this digest has been naming since August 22. Correct that first. Behind it, Bifrost downloads plugin shared objects from URLs handed to an unauthenticated endpoint, and three AI projects landed advisories with no released fix behind them.

Worth your morning

Open WebUI — seventeen advisories, one release, and this digest had the wrong floor. The batch published across seven days: four on August 29, three on the 30th, four on the 31st, six on September 4. Every one of them names 0.11.1 as the fix. 0.11.1 went out on August 25, four days before the first advisory appeared, which is the ordinary shape of a coordinated release — the version was on the shelf before anyone was told why.

The correction matters more than the arithmetic. This digest has carried "Open WebUI wants 0.11.0" as a standing item since August 22. Every advisory in this batch lists 0.11.0 as affected, as < 0.11.1 or <= 0.11.0. Anyone who took that advice landed on the last vulnerable version and has been sitting there for two weeks. The floor is 0.11.1; 0.11.3 is current and is what you want.

Six are high. GHSA-jmc6-2wr8-h3wj (8.7) is the worst: the terminal port-preview iframe hardcodes allow-same-origin, so the sandbox attribute that is supposed to separate previewed content from the application does not separate it, and the path runs to account takeover. GHSA-wpmr-8h3q-fwj7 (8.1) is an authentication bypass specific to SQLite deployments — wildcard characters in the OAuth subject claim match another user's identity, so the sign-in lands in the wrong account. GHSA-4v28-j6q3-5m4r (7.7) is DNS rebinding through the Playwright web loader into internal services. GHSA-3g9q-v48f-hh9w (7.5) stalls the server on unauthenticated OIDC back-channel logout requests. Two more at 7.1 cover server-side fetch reaching the Azure platform channel and non-admin deletion of admin-owned knowledge connections.

Read the medium ones as a group, because they say something the scores do not. GHSA-p78m-89r6-pgf7 (6.8) sends the user's session cookies to any tool server configured for bearer authentication — which is to say, to whatever third-party endpoint an admin wired up as a tool. GHSA-4qg5-cxx4-g927 (6.5) lets users rejected by the OAuth domain allowlist or role policy in through token exchange instead. GHSA-wjwr-xfp9-r66p (6.5) leaves an admin demoted by SSO role sync with read and write on every user's notes. GHSA-pcvc-8vrv-8q6w (4.3) exposes knowledge bases the caller cannot open through the built-in knowledge tool on most vector backends. Four separate access-control decisions that hold at the surface a user clicks and not at the one a request reaches.

If you run Open WebUI with SSO in front of it, upgrade and then check who is actually in it. The OAuth items mean your allowlist and your role policy were advisory, and a demotion you performed may not have taken.

Bifrost — the plugin path can be a URL. CVE-2026-86242 (8.1, AV:N/AC:H/PR:N/UI:N) affects the Bifrost HTTP transport below 2.0.0. POST /api/plugins accepts a plugin whose path is an http:// URL; the shared-object loader treats that as a download, writes the body to a temporary .so, and opens it. The endpoint is unauthenticated when governance.auth_config.is_enabled is false, and false is the default.

Your exposure splits on build, and the advisory is unusually clear about it. On the dynamically linked builds the vendor requires for custom Go plugins, the load succeeds and this is unauthenticated remote code execution as the Bifrost process user. On the published statically linked Docker image the load fails, and what remains is server-side request forgery. Bifrost is an AI gateway holding provider keys for a thousand-odd models, so the second outcome is not a comfortable one either.

transports/v2.0.0 shipped August 26 and the advisory published September 6, so the fix has been available for eleven days without anything telling you to take it. If the upgrade has to wait for a major-version review, turning on management authentication closes the endpoint today.

OpenMAIC — the SSRF check is skipped outside production. CVE-2026-86259 scores 9.0 under CVSS 4.0 and 7.5 under 3.1, which is the split this digest keeps running into; GitHub labels it critical on the newer scale. Everything below 1.0.1 is affected, and 1.0.1 published yesterday alongside the advisory.

The defect is the gate rather than the check. URL validation runs conditionally on the build being a production one, so a deployment that never set that flag — a demo, an internal pilot, a self-hosted copy someone started with npm run dev and left up — has no validation at all, and the x-base-url header or baseUrl parameter reaches cloud metadata. OpenMAIC is a multi-agent teaching front end with 32,000 stars and a one-click install story, which is a population weighted heavily toward exactly those deployments. If yours has been reachable, rotate whatever the metadata service on that host hands out.

Three with nowhere to upgrade to. nbviewer (CVE-2026-86258, 8.2 under CVSS 4.0) checks path containment in LocalFileHandler.can_show() with a string-prefix comparison, so a sibling directory whose name starts with the configured root reads as inside it and its files are served. The fix merged September 3 and Jupyter has cut no release for it — the repository has tags and no releases at all — so a hosted nbviewer is on the commit or on a root path with no siblings worth reading.

Rowboat (CVE-2026-86122, 5.3) does not validate custom MCP server and webhook URLs, so any authenticated user points the agent runtime at internal services and metadata endpoints. The advisory published September 5 and names no fixed version; issue #621 has been open since June 13. Releases have kept coming — 0.9.4 landed Saturday — so this is one where running current does not help and you want egress rules around the runtime instead.

openagents (CVE-2026-86237, 5.5) is unauthenticated SSRF through a base_url argument in the HTTP transport. The maintainer closed issue #566 as not_planned on August 31 and the advisory records that the same unguarded code still ships in 0.9.3.post20. Sibling endpoints in that file do call the admin check; this handler does not. Treat it as permanent and keep it off any network with a metadata service on it.

Standing items

Milvus, day twenty-seven. CVE-2026-69111 (8.7) is unchanged. PR #49847 is still open, merge state still dirty, no activity since August 14 — twenty-four days. Port 9091 stays firewalled.

Ollama remains clean. Still no published advisories, ever.

Carried unchanged from September 6: codewhale wants 0.8.64 with the cargo deepseek-tui crate still unfixed, vLLM wants 0.28.0, @typespec/spector wants 0.1.0-alpha.27, unstructured wants 0.24.0, NLTK wants 3.10.3 plus NLTK_PATHSEC_ENFORCE=1 with CVE-2026-81726 still open on current, MLflow wants 3.15.0, omnigent wants 0.3.0, orval wants 8.22.0, claude-code-templates wants 1.29.4, @toon-format/toon wants 2.3.1, @openclaw/feishu wants 2026.6.9, pnpm wants 10.34.5 / 11.11.0, nanoid wants 3.3.12 / 5.1.11, fast-uri wants 2.4.5 / 3.1.6 / 4.1.3, @faker-js/faker wants 10.5.0, banks wants 2.4.5, Chainlit wants 2.12.0 or MCP off, PraisonAI wants 4.6.58 with an audit after it, pantheon-agents wants 0.6.4 plus credential rotation, RestrictedPython wants 8.3, the npm MariaDB connector wants 3.2.4 / 3.3.3 / 3.4.6 / 3.5.3, engine.io wants 6.6.7, 9router is fixed for two of eleven at 0.5.2, vm2 wants 3.11.6, xinference wants 2.7.0, jsonata wants 1.8.8 / 2.2.1 with Node-RED still pinned below the floor, MONAI wants 1.6.0, hydra-core wants 1.3.4, Flowise is archived at 3.1.4 with four permanent criticals, mcp-florence2 is vendor-declined, the unfixed MCP servers from August 17 are unchanged, AgenticSeek needs its token set plus a loopback bind, Langflow wants 1.11.3, Traefik wants 2.11.52 / 3.6.23 / 3.7.7, go-git wants 5.19.2 or 6.0.0-alpha.5, n8n wants 1.123.69 / 2.33.4 / 2.34.1, SSH.NET wants the 2026.0.0 major, .NET wants 8.0.30 / 9.0.19 / 10.0.11.

Feed notes. GitHub's reviewed npm and pip databases have published nothing since September 4 — the weekend pause held through Sunday, and today's table comes from repository advisories and the unreviewed feed instead. Nothing on the Venicecom side clears the bar for a row: Angular shipped 22.1.5 on September 3 with no security designation, NuGet has published nothing since the low-severity Magick.NET memory leak on September 2, the August 11 .NET batch stands, and the next Microsoft cycle is tomorrow, Tuesday the 8th. PrimeNG has shipped nothing since 21.1.9 in June and remains security-fix-only.

Five h3 CVEs appeared in the unreviewed feed yesterday — CVE-2026-86251, 86253, 86250, 86252 and 86205 — and none of them is new. Each maps to a repository advisory published in March, all fixed then in 1.15.9 or 2.0.1-rc.18. This is CVE assignment catching up six months later, and a scanner that keys on publication date will raise them at you this week as though something happened. Nothing did.

Filtered out and why: nine libcurl CVEs published September 6 are a release-day batch, real and broad but on neither tracked stack. valkey, jsch, three PostgreSQL Anonymizer advisories, MISP, wger ×4, Open5GS, ZenHive and a large run of PocketMine-MP backfill are outside scope. The unreviewed feed was otherwise WordPress plugins, Samsung Walrus, MediaTek Android HAL components, NEC UNIVERGE firmware and roughly forty SourceCodester and code-projects PHP entries, with nothing in the AI stack in any of it.