6.8

CVE-2026-87015

Exploit

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached and a session or system OAuth connection was processed last, a request to a different server configured for bearer authentication could include the calling user's Open WebUI session cookies, allowing that server's operator to reuse the session and take over the account. This issue is fixed in version 0.11.1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Openwebui ≫ Open Webui Version >= 0.6.27 < 0.11.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.28% 0.203
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 6.8 1.6 5.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-201 Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

https://github.com/open-webui/open-webui/releases/tag/v0.11.1
Release Notes
https://github.com/open-webui/open-webui/commit/cd9db21c5276807a2975ddba17cef369ad1114b7
Patch
https://github.com/open-webui/open-webui/pull/28630
Patch
Issue Tracking
https://github.com/open-webui/open-webui/security/advisories/GHSA-p78m-89r6-pgf7
Vendor Advisory
Exploit