CVE-2026-59224: Open WebUI terminal proxy

Q: Is CVE-2026-59224 actively exploited?

No confirmed active exploitation of CVE-2026-59224 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-59224?

Upgrade to Open WebUI 0.10.0 or later immediately — this is a fixed vulnerability, not a config workaround situation. If immediate patching isn't possible, disable the terminal feature entirely for shared/multi-tenant instances, or restrict it to a single-trusted-admin deployment model. Ensure any reverse proxy in front of Open WebUI strips or rejects client-supplied X-User-Id headers rather than passing them through. Audit terminal session logs for mismatches between the authenticated session owner and the resolved user_id on ws_terminal connections, and rotate credentials/tokens for any accounts that may have had a terminal session hijacked. Track the fix via the GitHub Security Advisory GHSA-j657-m4c4-24jq and the referenced commit/PR for verification in your environment.

Q: What systems are affected by CVE-2026-59224?

This vulnerability affects the following AI/ML architecture patterns: self-hosted LLM chat UIs, multi-user AI ops platforms, agent/terminal-enabled AI workspaces, shared inference front-ends.

Q: What is the CVSS score for CVE-2026-59224?

CVE-2026-59224 has a CVSS v3.1 base score of 8.0 (HIGH). The EPSS exploitation probability is 0.39%.

CISO Take

Open WebUI's terminal feature builds its WebSocket backend URL from an unencoded session_id, letting an authenticated low-privilege user inject query parameters that override the user_id passed to the terminal service — and a companion HTTP proxy path trusts the client-supplied X-User-Id header with no integrity check, so identity there is effectively self-asserted. The danger isn't the CVSS 8.0 score in isolation (network-exploitable, scope-changed, full confidentiality/integrity/availability impact) but what a hijacked terminal session means in this product: Open WebUI's terminal grants a live shell tied to a user's context, so spoofing another user's identity can translate into unauthorized command execution, access to another user's chat/session data, or escalation into an admin session. There is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this isn't under active mass exploitation — but Open WebUI carries 130 other CVEs, a pattern of security debt in a package increasingly used as the front door to self-hosted LLM stacks. Attack complexity is high and requires an existing low-privilege account plus user interaction, which narrows realistic exploitation to insiders or anyone who already holds any account on a shared instance. Patch to 0.10.0 immediately; until then, disable or network-isolate the terminal feature and audit logs for terminal sessions where the resolved user_id doesn't match the authenticated session.

Sources: NVD GitHub Advisory github.com ATLAS

What is the risk?

High severity (CVSS 8.0) but not trivially exploitable at scale: PR:L and UI:R mean an attacker needs some existing low-privilege account plus a triggering interaction, and AC:H reflects the precision needed to craft the query injection. The scope change (S:C) is the key risk driver — the flaw lets an actor with limited privileges affect a security context beyond their own (another user's terminal identity), which is exactly the kind of horizontal/vertical privilege escalation CISOs should weight heavily regardless of complexity. No EPSS, no KEV listing, and no public PoC/Nuclei template today mean this is not an imminent mass-exploitation risk, but any multi-tenant or shared Open WebUI deployment with the terminal feature enabled — especially ones exposed to semi-trusted internal users — should treat this as urgent-but-not-yet-weaponized.

How does the attack unfold?

Entry: authenticated low-privilege session

Attacker holds or obtains any valid low-privilege Open WebUI account and interacts with the terminal feature, satisfying the PR:L/UI:R preconditions.

AML.T0012

Query injection into terminal proxy

Attacker crafts a session_id (or sets the X-User-Id header directly) that injects unsanitized query content into the ws_terminal upstream URL or HTTP proxy path.

Identity impersonation

The terminal backend resolves the connection under the injected/spoofed user_id since it trusts the unencoded session_id and unbound X-User-Id header, effectively authenticating the attacker as another user.

AML.T0106

Impact: unauthorized terminal access

Attacker obtains a live terminal session running under the victim's identity, enabling command execution, data exposure, or escalation to admin capabilities.

AML.T0050

Entry: authenticated low-privilege session

Attacker holds or obtains any valid low-privilege Open WebUI account and interacts with the terminal feature, satisfying the PR:L/UI:R preconditions.

AML.T0012

Query injection into terminal proxy

Attacker crafts a session_id (or sets the X-User-Id header directly) that injects unsanitized query content into the ws_terminal upstream URL or HTTP proxy path.

Identity impersonation

The terminal backend resolves the connection under the injected/spoofed user_id since it trusts the unencoded session_id and unbound X-User-Id header, effectively authenticating the attacker as another user.

AML.T0106

Impact: unauthorized terminal access

Attacker obtains a live terminal session running under the victim's identity, enabling command execution, data exposure, or escalation to admin capabilities.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	< 0.10.0	`0.10.0`
149.6K 4 dependents Pushed 3d ago 81% patched ~6d to patch Full package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

8.0 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 32% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI Required

S Changed

C High

I High

A High

What should I do?

1 step

Upgrade to Open WebUI 0.10.0 or later immediately — this is a fixed vulnerability, not a config workaround situation. If immediate patching isn't possible, disable the terminal feature entirely for shared/multi-tenant instances, or restrict it to a single-trusted-admin deployment model. Ensure any reverse proxy in front of Open WebUI strips or rejects client-supplied X-User-Id headers rather than passing them through. Audit terminal session logs for mismatches between the authenticated session owner and the resolved user_id on ws_terminal connections, and rotate credentials/tokens for any accounts that may have had a terminal session hijacked. Track the fix via the GitHub Security Advisory GHSA-j657-m4c4-24jq and the referenced commit/PR for verification in your environment.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Privacy Violation API Framework AML.T0012 - Valid Accounts AML.T0050 - Command and Scripting Interpreter AML.T0106 - Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2 - AI system operation and security controls

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-59224?

Open WebUI's terminal feature builds its WebSocket backend URL from an unencoded session_id, letting an authenticated low-privilege user inject query parameters that override the user_id passed to the terminal service — and a companion HTTP proxy path trusts the client-supplied X-User-Id header with no integrity check, so identity there is effectively self-asserted. The danger isn't the CVSS 8.0 score in isolation (network-exploitable, scope-changed, full confidentiality/integrity/availability impact) but what a hijacked terminal session means in this product: Open WebUI's terminal grants a live shell tied to a user's context, so spoofing another user's identity can translate into unauthorized command execution, access to another user's chat/session data, or escalation into an admin session. There is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this isn't under active mass exploitation — but Open WebUI carries 130 other CVEs, a pattern of security debt in a package increasingly used as the front door to self-hosted LLM stacks. Attack complexity is high and requires an existing low-privilege account plus user interaction, which narrows realistic exploitation to insiders or anyone who already holds any account on a shared instance. Patch to 0.10.0 immediately; until then, disable or network-isolate the terminal feature and audit logs for terminal sessions where the resolved user_id doesn't match the authenticated session.

Is CVE-2026-59224 actively exploited?

No confirmed active exploitation of CVE-2026-59224 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-59224?

Upgrade to Open WebUI 0.10.0 or later immediately — this is a fixed vulnerability, not a config workaround situation. If immediate patching isn't possible, disable the terminal feature entirely for shared/multi-tenant instances, or restrict it to a single-trusted-admin deployment model. Ensure any reverse proxy in front of Open WebUI strips or rejects client-supplied X-User-Id headers rather than passing them through. Audit terminal session logs for mismatches between the authenticated session owner and the resolved user_id on ws_terminal connections, and rotate credentials/tokens for any accounts that may have had a terminal session hijacked. Track the fix via the GitHub Security Advisory GHSA-j657-m4c4-24jq and the referenced commit/PR for verification in your environment.

What systems are affected by CVE-2026-59224?

This vulnerability affects the following AI/ML architecture patterns: self-hosted LLM chat UIs, multi-user AI ops platforms, agent/terminal-enabled AI workspaces, shared inference front-ends.

What is the CVSS score for CVE-2026-59224?

CVE-2026-59224 has a CVSS v3.1 base score of 8.0 (HIGH). The EPSS exploitation probability is 0.39%.

What is the AI security impact?

Affected AI Architectures

self-hosted LLM chat UIsmulti-user AI ops platformsagent/terminal-enabled AI workspacesshared inference front-ends

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0050 Command and Scripting Interpreter

AML.T0106 Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/open_webui/routers/terminals.py built the ws_terminal upstream URL from an unencoded session_id and appended user_id as a query parameter, allowing query injection to make the terminal backend resolve another user identity; the HTTP proxy path also forwarded X-User-Id as an integrity-unbound identity claim. This issue is fixed in version 0.10.0.

Exploitation Scenario

An attacker who holds any valid but restricted account on a shared Open WebUI instance opens a WebSocket connection to the terminal endpoint with a crafted session_id that embeds injected query-string content (e.g., an appended user_id parameter); because the backend concatenates the unencoded session_id directly into the upstream ws_terminal URL, the terminal backend resolves the connection under the injected identity — for example, an administrator's user_id — handing the attacker a live terminal session running with that user's execution context. Alternatively, on the HTTP proxy path, the attacker skips the WebSocket injection entirely and simply sets the X-User-Id header on requests, since it is forwarded as an unsigned, integrity-unbound identity claim, achieving the same impersonation with a single crafted HTTP request.

Weaknesses (CWE)

CWE-287 Improper Authentication Primary CWE-290 Authentication Bypass by Spoofing Primary CWE-287 Improper Authentication CWE-290 Authentication Bypass by Spoofing

CWE-287 — Improper Authentication: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.