CVE-2026-70490 in Open WebUI
Summary
by MITRE • 08/05/2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/open_webui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that get_verified_user enforces on HTTP terminal routes. An account whose role is pending, including a registered but unapproved account or an account deactivated back to pending, can open an interactive terminal session when at least one terminal server is configured and its access grants cover the account. This loses the account-approval boundary for terminal access while the HTTP terminal routes correctly reject the same account. This issue is fixed in 0.11.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability exists within the Open WebUI platform's authentication mechanism for terminal sessions, specifically affecting versions between 0.8.8 and 0.11.0. The core issue lies in the inconsistent security implementation between WebSocket and HTTP terminal routes, creating a privilege escalation vector through improper access control enforcement. This flaw represents a direct violation of the principle of least privilege and demonstrates a critical gap in the platform's security architecture.
The technical flaw manifests in the backend routing logic located at backend/open_webui/routers/terminals.py where the WebSocket terminal endpoint authenticates JWT tokens but fails to implement the same user role verification that HTTP terminal routes enforce. The get_verified_user function correctly validates account status and roles for HTTP endpoints, yet the WebSocket implementation bypasses this crucial security check by only validating the initial JWT message without enforcing the verified-user role gate. This creates a scenario where accounts in pending status can establish interactive terminal sessions despite being rejected by the HTTP interface.
The operational impact of this vulnerability is significant as it undermines the platform's intended access control policies and creates an unauthorized access pathway for accounts that should be restricted. An attacker could potentially leverage this weakness to gain terminal access using credentials from accounts that are registered but not yet approved, or accounts that have been deactivated but remain in pending status. This effectively bypasses the account approval boundary that security administrators rely upon to control access to sensitive system resources.
The vulnerability aligns with CWE-285 (Improper Authorization) and represents a clear deviation from secure coding practices as outlined in NIST SP 800-53 standards for authorization controls. From an adversarial perspective, this issue maps to ATT&CK technique T1078 (Valid Accounts) and T1059 (Command and Scripting Interpreter) as it enables unauthorized execution of commands through terminal sessions. The security gap essentially allows threat actors to exploit the inconsistent authentication implementation to establish persistent access channels that bypass normal account verification processes.
The fix implemented in version 0.11.0 addresses this by ensuring consistent enforcement of user verification checks across all terminal access methods, requiring proper role validation regardless of whether the session is established through HTTP or WebSocket protocols. This remediation restores the intended security boundary and ensures that pending accounts cannot gain terminal access through either interface, maintaining consistency with the platform's overall authorization framework and preventing unauthorized privilege escalation through the terminal subsystem.