CVE-2026-109292: Open WebUI session cookie leak to

CISO Take

Open WebUI versions 0.6.27 up to (but not including) 0.11.4 forward the full browser cookie jar, including the user's session cookie, to destination servers on OAuth-mode connections. Any operator of an OpenAI-compatible endpoint, OpenAPI tool server or terminal server connected to an instance can capture these cookies from routine requests and replay them to take over accounts, administrators included. The CVSS score is a moderate 6.8 because it needs user interaction and high complexity. In practice the risk is higher wherever third-party or community tool servers are connected, since admin takeover gives control over models, connections, and stored chat data. There is no public exploit, no Nuclei template, no KEV listing and no EPSS data yet, so exploitation is not currently observed. Upgrade to 0.11.4 or later, audit which external servers are connected, and rotate sessions and secrets if untrusted servers were ever attached.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

Medium by CVSS (6.8), but the effective risk depends on which external servers are connected. Exploitation needs no privileges and is passive once a user interacts with an OAuth-mode connection, and the attacker only needs to operate or compromise a destination server. Impact on confidentiality and integrity is high because a stolen session grants full account control, including admin. No known exploitation, no public PoC, no KEV or SSVC data at the time of publication (2026-10-12). Confidence: MEDIUM, since EPSS and dependents data are unavailable.

How does the attack unfold?

Initial Access

Attacker operates or compromises an OpenAI-compatible, OpenAPI tool or terminal server that is connected to Open WebUI in OAuth mode.

AML.T0010.005

Credential Capture

Routine requests from Open WebUI carry the full cookie jar, and the attacker's server logs the user's session cookie.

AML.T0091.000

Account Takeover

Attacker replays the captured session cookie to authenticate as the victim, potentially an administrator.

AML.T0012

Impact

Attacker reads chats, documents and stored API keys and may add malicious tools or connections to persist.

AML.T0025

Initial Access

Attacker operates or compromises an OpenAI-compatible, OpenAPI tool or terminal server that is connected to Open WebUI in OAuth mode.

AML.T0010.005

Credential Capture

Routine requests from Open WebUI carry the full cookie jar, and the attacker's server logs the user's session cookie.

AML.T0091.000

Account Takeover

Attacker replays the captured session cookie to authenticate as the victim, potentially an administrator.

AML.T0012

Impact

Attacker reads chats, documents and stored API keys and may add malicious tools or connections to persist.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	—	No patch
156.7K3 dependentsPushed 6d ago76% patched~20d to patchFull package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

6.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 35% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACHigh

PRNone

UIRequired

SUnchanged

CHigh

IHigh

ANone

What should I do?

1 step

1) Upgrade Open WebUI to 0.11.4 or later (see GHSA-gqfh-jxvw-74rp and the referenced fix commits). 2) Until patched, remove or disable OAuth-mode connections to servers you do not fully control. 3) Invalidate all active sessions and rotate the WEBUI_SECRET_KEY after upgrading if untrusted servers were connected. 4) Review admin audit logs for unexpected logins, new admin users, or changed connections and tools from unfamiliar IPs. 5) Inventory all configured external connections, tool servers and terminal servers, and restrict them to vetted operators. 6) Consider binding sessions to client attributes or placing the instance behind an SSO or reverse proxy that enforces additional checks.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassFrameworkPluginAPIAML.T0012- Valid Accounts AML.T0055- Unsecured Credentials AML.T0091.000- Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-109292?

Open WebUI versions 0.6.27 up to (but not including) 0.11.4 forward the full browser cookie jar, including the user's session cookie, to destination servers on OAuth-mode connections. Any operator of an OpenAI-compatible endpoint, OpenAPI tool server or terminal server connected to an instance can capture these cookies from routine requests and replay them to take over accounts, administrators included. The CVSS score is a moderate 6.8 because it needs user interaction and high complexity. In practice the risk is higher wherever third-party or community tool servers are connected, since admin takeover gives control over models, connections, and stored chat data. There is no public exploit, no Nuclei template, no KEV listing and no EPSS data yet, so exploitation is not currently observed. Upgrade to 0.11.4 or later, audit which external servers are connected, and rotate sessions and secrets if untrusted servers were ever attached.

Is CVE-2026-109292 actively exploited?

No confirmed active exploitation of CVE-2026-109292 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-109292?

1) Upgrade Open WebUI to 0.11.4 or later (see GHSA-gqfh-jxvw-74rp and the referenced fix commits). 2) Until patched, remove or disable OAuth-mode connections to servers you do not fully control. 3) Invalidate all active sessions and rotate the WEBUI_SECRET_KEY after upgrading if untrusted servers were connected. 4) Review admin audit logs for unexpected logins, new admin users, or changed connections and tools from unfamiliar IPs. 5) Inventory all configured external connections, tool servers and terminal servers, and restrict them to vetted operators. 6) Consider binding sessions to client attributes or placing the instance behind an SSO or reverse proxy that enforces additional checks.

What systems are affected by CVE-2026-109292?

This vulnerability affects the following AI/ML architecture patterns: LLM chat front ends, Agent tool servers (OpenAPI), Self-hosted LLM gateways, Multi-user AI platforms.

What is the CVSS score for CVE-2026-109292?

CVE-2026-109292 has a CVSS v3.1 base score of 6.8 (MEDIUM). The EPSS exploitation probability is 0.41%.

What is the AI security impact?

Affected AI Architectures

LLM chat front endsAgent tool servers (OpenAPI)Self-hosted LLM gatewaysMulti-user AI platforms

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0055Unsecured Credentials

AML.T0091.000Application Access Token

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.

Exploitation Scenario

An attacker publishes a free OpenAI-compatible endpoint or an OpenAPI tool server, or compromises an existing one, that an organization connects to its Open WebUI instance in OAuth mode. When users or the administrator use the connection, Open WebUI forwards the whole cookie jar with the routine requests, and the attacker's server logs the session cookie. The attacker replays the cookie against the Open WebUI instance, takes over the account and, if it belonged to an administrator, reads all chats, harvests stored API keys, and adds malicious tools or functions to maintain access and move laterally.

Weaknesses (CWE)

CWE-200Exposure of Sensitive Information to an Unauthorized ActorPrimary CWE-200Exposure of Sensitive Information to an Unauthorized Actor

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.