CVE-2026-59224 Open WebUI Authentication Bypass & Privilege Escalation Vulnerability

Technical summary

The vulnerability stems from two related weaknesses in the terminal routing logic (backend/open_webui/routers/terminals.py). First, the WebSocket terminal upstream URL is constructed by directly appending an unencoded session_id parameter and user_id query string, creating a query injection vector where an attacker can craft a malicious session ID containing additional query parameters to override the intended user context. Second, the HTTP proxy layer forwards the X-User-Id header as an identity claim without integrity verification, allowing an authenticated client to arbitrarily specify which user identity should be associated with their terminal session. Together, these flaws enable privilege escalation or lateral movement between user accounts within the same Open WebUI instance. The issue is resolved in version 0.10.0 through proper input encoding and removal of the unverified header trust.

Business impact

This vulnerability poses a significant risk to organizations deploying Open WebUI for internal AI services, particularly in multi-user environments. An authenticated user can impersonate other users and access their terminal sessions, potentially leading to unauthorized access to sensitive data, code execution under a different user's context, and lateral movement within the platform. In shared hosting or team collaboration scenarios, this could undermine access controls and create compliance violations if sensitive operations are performed via the terminal interface. The need for prior authentication and user interaction limits but does not eliminate real-world risk, especially in organizations with permissive access policies or where users are routinely guided through platform features.

Affected systems

Open WebUI versions prior to 0.10.0 are affected. This includes all 0.9.x releases and earlier versions. The vulnerability affects instances regardless of deployment model (cloud, on-premises, containerized) as long as the terminal feature is enabled. Users running version 0.10.0 or later are not vulnerable.

Exploitability

Exploitation requires an attacker to already possess valid credentials and an active session on the Open WebUI instance. The attack also requires user interaction (UI:R in the CVSS vector), suggesting the attacker must trick or socially engineer a target user into taking an action—such as clicking a link or visiting a malicious webpage—that triggers the query injection. The attack vector is network-based, but the moderate complexity (AC:H) reflects the combined requirement for authentication, social engineering, and specific UI interaction. This places it in the 'opportunistic but not trivial' category; automated scanning or mass exploitation is unlikely, but targeted attacks against known users are feasible.

Remediation

Upgrade Open WebUI to version 0.10.0 or later. This version implements proper URL encoding for session parameters and removes the unverified X-User-Id header trust, ensuring that user identity is derived from authenticated session context only. For organizations unable to upgrade immediately, disable the terminal feature if it is not actively used, and implement network-level restrictions to limit access to the terminal endpoint to trusted internal networks only.

Patch guidance

Apply the 0.10.0 release as soon as practicable. If you are operating Open WebUI in a containerized environment, update your container image to the latest available version from the official Open WebUI repository. If you are running from source, pull the latest main branch or check the releases page for version 0.10.0 or higher. Verify the update by confirming the version string in the Open WebUI UI or API response headers. No additional configuration changes are required post-update.

Detection guidance

Monitor HTTP access logs for unusual X-User-Id header values that do not match the authenticated session user. Look for WebSocket upgrade requests to the terminal endpoint with suspicious query parameters appended to the session ID—such as encoded characters or parameter-like syntax (=, &, %) within what should be a simple alphanumeric session identifier. Check terminal access logs for session entries associated with users accessing terminals outside their normal working patterns or at unexpected times. Alert on any cross-user terminal access attempts detected through session correlation.

Why prioritize this

Although the vulnerability requires authentication and user interaction, the ability to escalate privileges and access other users' sessions represents a direct compromise of access controls in a multi-user platform. In environments where Open WebUI is used for team collaboration or sensitive AI workloads, this poses a material risk. The HIGH CVSS score (8.0) and the relative ease of exploitation once a user is compromised justify prompt patching. Organizations with a small user base or in isolated network environments may deprioritize slightly, but any multi-team deployment should treat this as critical.

Risk score, explained

The CVSS 3.1 score of 8.0 (HIGH) reflects: (1) Network attack vector—the vulnerability is exploitable over the network without special access; (2) High impact on confidentiality and integrity—an attacker can read other users' terminal sessions and execute commands as another user; (3) High impact on availability—potential for disruption of service or resources; (4) Authentication requirement—reduces likelihood but does not eliminate risk in organizations with permissive user provisioning; (5) User interaction—social engineering or tricking a user is required, moderating the score but remaining practical. The scope is marked as Changed because the attacker, starting with limited user privileges, can perform actions affecting other users' security domains.

Frequently asked questions