CVE-2026-109289: Open WebUI: terminal WebSocket skips revocation check

MEDIUM

Published October 12, 2026

CISO Take

Open WebUI versions 0.8.8 through 0.11.3 only check authorization on the first message of the terminal proxy WebSocket (CWE-613, insufficient session expiration), so a user who has been deactivated can keep running commands and reading or writing files on the terminal server through a connection that was already open. Exploitation needs a low-privilege account and an existing session, and the CVSS score is a moderate 6.3. There is no EPSS data, no public exploit, no Nuclei template, and no CISA KEV listing. Even so, offboarding is a common control for insider-risk and leaver scenarios. A fired or suspended user who left a terminal tab open keeps shell-level access to the host that runs the terminal server. The package has only 3 tracked downstream dependents, but it has 186 other CVEs, so patching should be routine. Upgrade to 0.11.4 or later, restart the service so lingering sockets are dropped, and review terminal activity for accounts deactivated during the exposure window.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

Medium overall. Network-reachable and low complexity, with no user interaction, but it needs a valid account whose session was already open before deactivation. The practical risk is higher for organizations that expose terminal features to many users or run the terminal server with broad host or data access, because the confidentiality, integrity and availability impact then extends beyond the Open WebUI application. There is no known exploitation, EPSS is unavailable and no public PoC exists, so near-term likelihood is low to moderate and concentrated in insider and offboarding scenarios.

How does the attack unfold?

Initial Access

Attacker holds a valid low-privilege Open WebUI account and opens a terminal WebSocket before being deactivated.

AML.T0012

Authorization Bypass

After deactivation, the terminal proxy route does not re-check access on later messages, so the open socket stays authorized.

AML.T0049

Execution

The former user keeps sending commands over the WebSocket to run them on the terminal server.

AML.T0050

Impact

Files are read or modified on the terminal server, exposing secrets and data and altering the environment.

AML.T0037

Initial Access

Attacker holds a valid low-privilege Open WebUI account and opens a terminal WebSocket before being deactivated.

AML.T0012

Authorization Bypass

After deactivation, the terminal proxy route does not re-check access on later messages, so the open socket stays authorized.

AML.T0049

Execution

The former user keeps sending commands over the WebSocket to run them on the terminal server.

AML.T0050

Impact

Files are read or modified on the terminal server, exposing secrets and data and altering the environment.

AML.T0037

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	—	No patch
156.7K3 dependentsPushed 6d ago76% patched~20d to patchFull package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 12% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

ILow

ALow

What should I do?

1 step

1) Upgrade open-webui to 0.11.4 or later. 2) Restart Open WebUI and the terminal server after patching to terminate stale WebSocket sessions. 3) Until patched, when deactivating a user, restart the service or kill their terminal sessions and rotate any secrets they could reach. 4) Restrict terminal access to trusted users and run the terminal server in an isolated, least-privilege container or host with no sensitive mounts. 5) Detect: review terminal server and WebSocket logs for commands or file operations by deactivated accounts after their deactivation time. 6) Limit network exposure of the terminal endpoint with a reverse proxy or VPN.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassCode ExecutionFrameworkAgentAML.T0012- Valid Accounts AML.T0037- Data from Local System AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.9.2-Processes for responsible use of AI systems

NIST AI RMF

GOVERN 1.4-Risk management processes and controls are established and documented

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-109289?

Is CVE-2026-109289 actively exploited?

No confirmed active exploitation of CVE-2026-109289 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-109289?

1) Upgrade open-webui to 0.11.4 or later. 2) Restart Open WebUI and the terminal server after patching to terminate stale WebSocket sessions. 3) Until patched, when deactivating a user, restart the service or kill their terminal sessions and rotate any secrets they could reach. 4) Restrict terminal access to trusted users and run the terminal server in an isolated, least-privilege container or host with no sensitive mounts. 5) Detect: review terminal server and WebSocket logs for commands or file operations by deactivated accounts after their deactivation time. 6) Limit network exposure of the terminal endpoint with a reverse proxy or VPN.

What systems are affected by CVE-2026-109289?

This vulnerability affects the following AI/ML architecture patterns: LLM chat interfaces, Agent tool and terminal execution environments, Self-hosted model serving front ends.

What is the CVSS score for CVE-2026-109289?

CVE-2026-109289 has a CVSS v3.1 base score of 6.3 (MEDIUM). The EPSS exploitation probability is 0.21%.

What is the AI security impact?

Affected AI Architectures

LLM chat interfacesAgent tool and terminal execution environmentsSelf-hosted model serving front ends

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0037Data from Local System

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.9.2

NIST AI RMF: GOVERN 1.4

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through an already open terminal WebSocket. Because the terminal proxy route in terminals.py checks access only on the first message, deactivated users can keep running commands and reading or writing files on the terminal server.

Exploitation Scenario

An engineer with a low-privilege Open WebUI account opens a terminal session and keeps the WebSocket connected. The security team deactivates the account during offboarding. Because the proxy route checks authorization only on the first message, the former employee continues to send commands over the same socket. They list files, read model configs, API keys and datasets on the terminal server, and write or modify scripts there. This gives them persistent access after their account was supposed to be revoked.

Weaknesses (CWE)

CWE-613Insufficient Session Expiration

CWE-613 — Insufficient Session Expiration: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."