CVE-2026-59216: Open WebUI Session Hijacking Allows Code Execution

Technical summary

The vulnerability stems from insufficient authorization checks in Open WebUI's Socket.IO event handling. The get_event_call function accepts execute:python and execute:tool events and routes them to a client-specified session_id after confirming the session exists and is connected. However, it fails to verify that the authenticated user making the request is the legitimate owner of the target session. An authenticated attacker can enumerate or learn other session IDs (particularly through observing ydoc:document:join events in collaborative or multi-user scenarios) and inject code execution requests into those sessions. This maps to improper access control (CWE-862), information exposure (CWE-200), authorization bypass (CWE-639), and improper code neutralization (CWE-94).

Business impact

In multi-user Open WebUI deployments, this vulnerability enables privilege escalation and lateral movement among authenticated users. An attacker can silently execute Python code or trigger tool integrations within another user's session—potentially exfiltrating data, modifying resources, or performing actions that appear to originate from the victim. For organizations using Open WebUI for sensitive AI tasks, data analysis, or integration with external tools, this poses a risk of data theft, unauthorized modifications, and compliance violations. The attack requires prior authentication and some user interaction, limiting broad exposure but creating meaningful risk in collaborative environments.

Affected systems

Open WebUI versions 0.9.x and earlier are vulnerable. The fix is available in version 0.10.0 and later. Self-hosted deployments are affected; managed or cloud-hosted instances depend on whether the provider has upgraded. Users running Open WebUI in containerized or on-premises environments should verify their current version immediately.

Exploitability

Exploitation requires valid authentication credentials and discovery of another user's Socket.IO session identifier. While the attack vector is network-based, the authentication requirement and the need to learn a valid session ID (requiring either social engineering, network observation, or luck in collaborative scenarios) limit casual or automated exploitation. The attack does not require special privileges beyond basic user authentication. Once a session ID is known, the execution is straightforward: crafting a Socket.IO message to the execute:python or execute:tool handler. CVSS 7.7 (HIGH) reflects the high impact (code execution) tempered by the authentication and user interaction prerequisites.

Remediation

Upgrade to Open WebUI version 0.10.0 or later. The patch introduces proper session ownership validation in the get_event_call handler, ensuring that only the authenticated user who owns a session can trigger code execution within it. Deploying 0.10.0 immediately is strongly recommended for any multi-user or production instance. If immediate patching is not possible, operators should restrict network access to Open WebUI instances, limit the number of authenticated users, and monitor Socket.IO event logs for suspicious cross-session execute requests.

Patch guidance

Update Open WebUI to version 0.10.0 or later via your deployment method (Docker, pip, source). Verify the running version with your package manager or by checking the application's about/version endpoint. After upgrade, restart all Open WebUI services and validate that existing sessions are not disrupted. For large deployments, test the patch in a staging environment first to ensure compatibility with your tool integrations and data workflows.

Detection guidance

Monitor Socket.IO logs and event streams for get_event_call messages that execute Python or tools in sessions not owned by the authenticated requester. Log the source user, target session ID, and event type. Look for patterns such as the same user triggering events across multiple different session IDs in short timeframes, or non-owner users attempting execute:python or execute:tool. Network-based detection is difficult without Socket.IO protocol inspection; focus on application-level logging. Review recent code execution audit trails to identify any unexplained tool invocations or Python runs.

Why prioritize this

Prioritize this vulnerability in multi-user Open WebUI environments. Single-user or air-gapped instances face lower risk. The HIGH CVSS score, ease of exploitation once a session ID is known, and potential for sensitive data exposure or unauthorized tool execution in AI/data analysis contexts make this a near-term patching target. Organizations using Open WebUI for customer-facing AI services, data analysis, or integration with external APIs should treat this as critical.

Risk score, explained

CVSS 7.7 (HIGH) reflects a high-impact vulnerability—unauthenticated code execution within a user's session—combined with moderate attack barriers. The network vector (AV:N) and lack of attack complexity (AC:H suggests some difficulty in discovering valid session IDs) are balanced by the requirement for prior authentication (PR:L) and user interaction (UI:R). The scope change (S:C) acknowledges that compromised code execution can affect other resources or users. Confidentiality and integrity are fully compromised (C:H, I:H); availability is not directly impacted (A:N) by the code execution itself, though downstream effects are possible.

Frequently asked questions