CVE-2026-109572 in Open WebUI
Summary
by MITRE • 10/13/2026
Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/{server_id}/{path} to list or stop other users' terminals and modify terminal policies, injecting environment variables into other users' terminals.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Open WebUI versions prior to 0.11.4 represents a critical privilege escalation flaw rooted in the improper access control mechanisms of its terminal proxy subsystem. This component is designed to facilitate interaction with backend services through a web-based interface, but it fails to adequately validate whether an authenticated user has the necessary permissions to execute administrative operations on behalf of other users or system administrators. The core technical deficiency lies in the handling of authentication tokens and API keys within the request routing logic for terminal management endpoints. Specifically, the application allows any authenticated session to attach a shared key that grants elevated privileges when interacting with specific internal APIs, bypassing standard role-based access controls intended to isolate user sessions from administrative functions.
From a technical perspective, the exploitation vector centers on the endpoint /api/v1/terminals/{server_id}/{path}. This path structure is typically reserved for managing terminal instances associated with specific backend servers. However, due to the flawed validation logic, an attacker who has obtained valid credentials can manipulate this endpoint to target resources belonging to other users or administrative accounts. By appending a shared key that possesses administrator-level permissions, the attacker effectively impersonates a system operator. This allows them to invoke methods such as listing active terminal sessions for any user on the network and terminating those sessions forcibly. Furthermore, the vulnerability extends beyond simple disruption; it permits the modification of terminal policies and the injection of arbitrary environment variables into other users' terminal processes.
The operational impact of this vulnerability is severe, affecting both confidentiality and integrity within the deployment environment. An attacker can achieve a denial-of-service condition by stopping critical user terminals, thereby disrupting ongoing workloads or development activities for legitimate users. More critically, the ability to inject environment variables opens significant avenues for further compromise. Environment variables often contain sensitive configuration data, such as database connection strings, API keys, or internal service endpoints. By injecting malicious values into these variables within a victim's terminal session, an attacker can potentially influence how applications behave during execution, leading to information disclosure or facilitating subsequent attacks like server-side request forgery if the injected environment is consumed by downstream services.
This vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, as it allows users to assume roles and execute actions beyond their authorized scope. Additionally, from a tactical perspective, this behavior maps closely to MITRE ATT&CK technique T1078, Valid Accounts, where an attacker uses legitimate credentials to gain access, combined with aspects of T1534, Internal Spearphishing or lateral movement via compromised sessions, as the ability to manipulate other users' environments facilitates deeper penetration into the network. The shared key mechanism suggests a design flaw in how administrative secrets are distributed and validated within the application's proxy layer, indicating that trust boundaries were not properly enforced at the API gateway level.
To mitigate this risk, organizations running Open WebUI versions between 0.8.6 and 0.11.4 should immediately upgrade to version 0.11.4 or later, where these access control checks have been rectified. In environments where upgrading is not immediately feasible, network-level segmentation can provide a temporary layer of defense by restricting direct access to the terminal proxy endpoints from untrusted networks. It is also advisable to audit existing deployments for any unauthorized modifications to terminal policies and review logs for anomalous requests targeting the /api/v1/terminals path with elevated key attachments. Regular rotation of shared keys and enforcing strict least-privilege principles for API tokens will further reduce the attack surface associated with this class of vulnerabilities.