AI Platform Flaws in Open WebUI and Dify Expose Critical AppSec Gaps

Kaspersky published its vulnerability intelligence analysis highlighting a marked surge in application security flaws across generative AI tooling and open-source platforms [1.1.2]. Among the key disclosures are CVE-2026-45386, an improper access control flaw in Open WebUI where state-changing write requests are processed after checking only read permissions without verifying write authorization; CVE-2026-41948, a path traversal vulnerability in the Dify AI orchestration platform that allows attackers to breach workspace isolation and expose internal service interfaces; and CVE-2026-25253, a gatewayUrl vulnerability in OpenClaw. The report underscores that the accelerated adoption of AI in software development and vulnerability research is shortening the window between vulnerability discovery and weaponization. These findings highlight a significant operational threat for DevOps, AppSec, and platform teams managing AI workflows. Vulnerabilities such as broken access control and path traversal in orchestration platforms like Dify and frontends like Open WebUI allow attackers or unauthorized users to bypass workspace tenant boundaries, extract proprietary data, and reach internal network endpoints. Because teams frequently deploy AI interfaces with direct access to back-end databases, API gateways, and vector data stores to facilitate autonomous agent actions, any breach of the management or UI tier can lead to lateral movement into sensitive core infrastructure. This trend reflects a well-established pattern across modern cloud infrastructure: rapid feature velocity in newly adopted technology layers consistently outpaces foundational security hygiene. Just as microservices and early container adoption exposed gaps in network segmentation and API security, the rush to deploy AI wrappers and orchestration frameworks has reintroduced classic OWASP Top 10 flaws into modern enterprise stacks. The issue is further compounded as automated code generation tools inadvertently propagate legacy coding anti-patterns into production services. In practice, security and platform engineers must immediately verify running versions of Open WebUI, Dify, and associated open-source AI frameworks to apply vendor patches. Teams should enforce strict server-side authorization checks on every state-altering API call, implement robust input sanitization, and place AI orchestrators inside isolated network segments with zero implicit trust toward internal services. Furthermore, multi-tenant AI deployments must rely on hardened infrastructure sandboxes rather than relying exclusively on application-level routing logic to enforce boundary controls.