Open WebUI up to 0.9.x Terminal Backend terminals.py session_id/user_id injection

Summaryinfo

A vulnerability was found in Open WebUI up to 0.9.x and classified as critical. This impacts an unknown function of the file backend/open_webui/routers/terminals.py of the component Terminal Backend. Such manipulation of the argument session_id/user_id leads to injection. This vulnerability is documented as CVE-2026-59224. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Open WebUI up to 0.9.x and classified as critical. Affected by this issue is an unknown code of the file backend/open_webui/routers/terminals.py of the component Terminal Backend. The manipulation of the argument session_id/user_id with an unknown input leads to a injection vulnerability. Using CWE to declare the problem leads to CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/open_webui/routers/terminals.py built the ws_terminal upstream URL from an unencoded session_id and appended user_id as a query parameter, allowing query injection to make the terminal backend resolve another user identity; the HTTP proxy path also forwarded X-User-Id as an integrity-unbound identity claim. This issue is fixed in version 0.10.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-59224 since 07/02/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1055.

Upgrading to version 0.10.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Open WebUI

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion