CVE-2026-109289 in Open WebUI
Summary
by MITRE • 10/12/2026
Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through an already open terminal WebSocket. Because the terminal proxy route in terminals.py checks access only on the first message, deactivated users can keep running commands and reading or writing files on the terminal server.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The identified security flaw resides within Open WebUI versions ranging from 0.8.8 up to but not including 0.11.4, specifically affecting the authentication and authorization mechanisms governing WebSocket-based terminal sessions. This vulnerability is classified as an improper access control issue where the system fails to enforce consistent state checks during a persistent connection lifecycle. The core of the problem lies in how the application handles session validation for interactive shell terminals accessed via WebSocket protocols. When a user initiates a terminal session, the server establishes a bidirectional communication channel that allows for real-time command execution and output retrieval. However, the authorization logic implemented within the terminal proxy route is insufficiently robust because it performs access verification only at the moment of connection initiation or upon receipt of the very first message in the stream.
This architectural oversight creates a significant window of opportunity for exploitation by malicious actors who have previously obtained valid credentials but were subsequently deactivated or disabled by an administrator. In typical enterprise environments, user deactivation is intended to immediately revoke all access privileges and terminate active sessions. However, due to this specific implementation flaw, once the WebSocket connection is established while the account was still active, the server does not re-validate the user's status for subsequent messages sent through that same open channel. Consequently, a deactivated user can continue to send commands, read sensitive files, write data, or execute arbitrary code on the underlying terminal server without triggering an authentication failure or session termination. This effectively bypasses the intended security controls designed to isolate compromised or terminated accounts from critical infrastructure resources.
The operational impact of this vulnerability is severe, particularly in environments where Open WebUI serves as a gateway for administrative tasks or development workflows involving direct shell access. An attacker with knowledge of previously valid credentials can exploit this state persistence to maintain unauthorized persistent access even after their account has been flagged for deactivation. This undermines the principle of least privilege and complicates incident response efforts, as standard revocation procedures do not immediately sever active connections. The ability to read or write files on the terminal server further escalates the risk, potentially leading to data exfiltration, lateral movement within internal networks if the terminal host is connected to other systems, or complete system compromise depending on the privileges associated with the shell process.
From a classification perspective, this vulnerability aligns closely with CWE-284, which describes Improper Access Control, specifically highlighting failures in enforcing authorization policies during ongoing interactions rather than just at initial entry points. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, as the attacker leverages credentials that are technically valid but should have been rendered ineffective by administrative action. Furthermore, because the attack vector involves maintaining an active session after a change in authorization status, it relates to aspects of Session Management flaws often categorized under CWE-613, Insufficient Session Expiration. The persistence of access through WebSocket channels highlights a common pitfall in real-time application development where state changes are not propagated or checked against existing long-lived connections.
To mitigate this risk, immediate action is required by upgrading Open WebUI to version 0.11.4 or later, where the developers have addressed this authorization gap. In versions prior to the fix, administrators should implement compensating controls such as network-level firewall rules that restrict WebSocket traffic from untrusted sources and ensure that terminal access is limited to highly privileged users who are subject to rigorous monitoring. Additionally, implementing a mechanism on the server side to periodically re-validate user status against the database for active WebSocket connections would provide an additional layer of defense. Security teams should also audit existing logs for any signs of unauthorized command execution by deactivated accounts and consider revoking all active sessions upon account deactivation through administrative scripts or configuration changes until the software is updated.