CVE-2026-109572: Open WebUI: terminal proxy privilege escalation

HIGHPoC AVAILABLE

Published October 12, 2026

CISO Take

Open WebUI versions 0.8.6 through 0.11.3 contain a missing-authorization flaw (CWE-862) in the terminal proxy. Any authenticated low-privilege user can reach the Terminals administrator API with the shared key attached. From there they can list or stop other users' terminals and rewrite terminal policies, including injecting environment variables into other users' sessions. No EPSS score, public exploit, Nuclei template, or KEV listing exists yet, so exploitation risk is unquantified, but the attack is low complexity over the network and needs only a standard account. The package has 187 other CVEs on record and an advisory with a published patch commit, which makes reverse-engineering the fix easy. Upgrade to 0.11.4 or later, and until then restrict the terminals feature and review who holds accounts on shared instances.

Sources:NVDGitHub AdvisoryVulnCheckATLASopen-webui GitHub

What is the risk?

High (CVSS 7.6). The attack is network-reachable, low complexity, needs low privileges and no user interaction. Integrity impact is high because an attacker can change terminal policies and inject environment variables into other users' terminals. Confidentiality and availability impact are low: terminals can be listed and stopped. Exposure is greatest on multi-user Open WebUI deployments where the Terminals feature is enabled and many users hold accounts. EPSS is unavailable, no public exploit or scanner template exists, and the issue is not in CISA KEV, so there is no evidence of active exploitation. The public patch commit lowers the barrier for an attacker to develop an exploit. Only 3 downstream dependents are known, so supply-chain blast radius is small, but direct deployments are the main exposure.

How does the attack unfold?

Initial Access

The attacker logs in with any low-privilege account on a multi-user Open WebUI instance.

AML.T0012

Privilege Escalation

The attacker calls /api/v1/terminals/{server_id}/{path}, and the proxy attaches the shared administrator key.

AML.T0049

Execution

The attacker modifies terminal policies to inject environment variables into other users' terminals.

AML.T0050

Impact

Other users' terminals are stopped or compromised, exposing credentials and breaking tenant isolation.

AML.T0048

Initial Access

The attacker logs in with any low-privilege account on a multi-user Open WebUI instance.

AML.T0012

Privilege Escalation

The attacker calls /api/v1/terminals/{server_id}/{path}, and the proxy attaches the shared administrator key.

AML.T0049

Execution

The attacker modifies terminal policies to inject environment variables into other users' terminals.

AML.T0050

Impact

Other users' terminals are stopped or compromised, exposing credentials and breaking tenant isolation.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	—	No patch
156.7K3 dependentsPushed 6d ago76% patched~20d to patchFull package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

7.6 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 23% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

IHigh

ALow

What should I do?

1 step

1) Upgrade open-webui (pip) to 0.11.4 or later; the fix is in commit 51bb8cb142f72503e861eeee25ae4dc73c26c36b and advisory GHSA-q46m-r89w-j74p. 2) Until patched, disable the Terminals feature or block /api/v1/terminals/ at the reverse proxy for non-admin users. 3) Rotate the shared Terminals key and any secrets exposed in terminal environments if untrusted users had accounts. 4) Detect abuse by reviewing proxy and application logs for requests to /api/v1/terminals/ from non-admin accounts, unexpected terminal stops, and policy or environment variable changes. 5) Audit user accounts and disable open self-registration on affected instances.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassCode ExecutionFrameworkAPIAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and mechanisms to disengage or deactivate AI systems

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-109572?

Is CVE-2026-109572 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-109572, increasing the risk of exploitation.

How to fix CVE-2026-109572?

1) Upgrade open-webui (pip) to 0.11.4 or later; the fix is in commit 51bb8cb142f72503e861eeee25ae4dc73c26c36b and advisory GHSA-q46m-r89w-j74p. 2) Until patched, disable the Terminals feature or block /api/v1/terminals/ at the reverse proxy for non-admin users. 3) Rotate the shared Terminals key and any secrets exposed in terminal environments if untrusted users had accounts. 4) Detect abuse by reviewing proxy and application logs for requests to /api/v1/terminals/ from non-admin accounts, unexpected terminal stops, and policy or environment variable changes. 5) Audit user accounts and disable open self-registration on affected instances.

What systems are affected by CVE-2026-109572?

This vulnerability affects the following AI/ML architecture patterns: Self-hosted LLM web interfaces, Multi-tenant AI workbenches, Agent and terminal execution environments, Model serving front ends.

What is the CVSS score for CVE-2026-109572?

CVE-2026-109572 has a CVSS v3.1 base score of 7.6 (HIGH). The EPSS exploitation probability is 0.30%.

What is the AI security impact?

Affected AI Architectures

Self-hosted LLM web interfacesMulti-tenant AI workbenchesAgent and terminal execution environmentsModel serving front ends

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/{server_id}/{path} to list or stop other users' terminals and modify terminal policies, injecting environment variables into other users' terminals.

Exploitation Scenario

An attacker registers, or compromises, a standard account on a company's shared Open WebUI instance with Terminals enabled. They send authenticated requests to /api/v1/terminals/{server_id}/ and the proxy attaches the shared administrator key. They list all active terminals, then modify the terminal policy to inject malicious environment variables into a data scientist's terminal, such as a poisoned proxy setting or a variable that loads attacker-controlled code. When the victim next runs a command, the attacker captures API keys and model credentials or gains code execution. They can also stop terminals to disrupt work and cover their tracks.

Weaknesses (CWE)

CWE-862Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.