CVE-2026-59715: Open WebUI unauth Socket.IO bypass

Q: Is CVE-2026-59715 actively exploited?

No confirmed active exploitation of CVE-2026-59715 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-59715?

Upgrade Open WebUI to 0.10.0 or later, which enforces authentication on the ydoc:awareness:update and ydoc:document:leave Socket.IO handlers. Until patched, place the Socket.IO endpoint behind network controls (VPN, firewall allow-list, reverse-proxy auth) so it is not reachable by unauthenticated external clients, and disable the collaborative document feature if not actively used. For detection, monitor Socket.IO connection logs for sessions that emit ydoc:* events without a preceding authenticated handshake, and review the vendor advisory (GHSA-gmfw-g93r-vg53) and fix commit (22f2fe1) for handler-level detail if building custom instrumentation.

Q: What systems are affected by CVE-2026-59715?

This vulnerability affects the following AI/ML architecture patterns: self-hosted LLM web UI / workspace collaboration layer, real-time collaborative editing (Socket.IO/CRDT) components in AI front-ends.

Q: What is the CVSS score for CVE-2026-59715?

CVE-2026-59715 has a CVSS v3.1 base score of 3.1 (LOW). The EPSS exploitation probability is 0.22%.

CISO Take

Open WebUI's real-time collaborative document editor runs its Socket.IO server with always_connect=True, so the ydoc:awareness:update and ydoc:document:leave event handlers process messages from clients that never completed authentication, letting an unauthenticated party inject fake presence updates or force other users out of a shared document session. The blast radius is narrow — CVSS 3.1 (low), integrity impact limited to collaboration metadata, no confidentiality or availability loss, and EPSS sits at 0.00222 (roughly the top 87th percentile of all scored CVEs, but still a near-negligible absolute exploitation probability) — and there is no public PoC, no Nuclei template, and it is not in CISA KEV. The attack complexity is rated high, meaning an adversary needs specific conditions (network reachability to the collaboration namespace and awareness of the event schema) rather than a trivial one-shot bypass. Open WebUI has a track record of frequent findings (130 other CVEs against the package, risk score 38/100), so treat this as one more entry in an ongoing pattern rather than an isolated one-off. Action: upgrade self-hosted instances to 0.10.0; until patched, restrict network exposure of the Socket.IO/collab endpoint to trusted networks and monitor for socket connections that skip the authenticated handshake.

Sources: NVD GitHub Advisory EPSS CISA KEV ATLAS

What is the risk?

Low severity by CVSS (3.1) and low real-world urgency: no active exploitation signal (not in KEV, no SSVC decision), no public exploit code or scanner template, and EPSS absolute probability is negligible (0.00222) despite ranking in the upper exploitation-probability percentile among all CVEs. Attack complexity is high and privileges required are low, meaning exploitation isn't push-button but also doesn't require deep AI/ML expertise — a general web-app / Socket.IO skillset suffices. The confidentiality and availability impact are both none; only integrity of collaborative document state is affected (CVSS I:L). The main risk driver for a CISO is exposure surface: any self-hosted Open WebUI instance reachable on the network with collaborative document features enabled is affected, and the package's history of 130 prior CVEs plus a risk score of 38/100 suggests this project warrants closer patch-cadence scrutiny than its individual CVE severities imply.

How does the attack unfold?

Initial Access

Attacker connects to the exposed Socket.IO collaboration endpoint, which accepts the connection without completing authentication due to always_connect=True.

AML.T0049

Exploitation

Attacker sends crafted ydoc:awareness:update or ydoc:document:leave events that the server processes without verifying the sender's identity (CWE-306).

Impact

Collaborative document awareness state is spoofed and/or legitimate users are forcibly disconnected from shared editing sessions, undermining integrity and trust in the workspace feature.

Initial Access

Attacker connects to the exposed Socket.IO collaboration endpoint, which accepts the connection without completing authentication due to always_connect=True.

AML.T0049

Exploitation

Attacker sends crafted ydoc:awareness:update or ydoc:document:leave events that the server processes without verifying the sender's identity (CWE-306).

Impact

Collaborative document awareness state is spoofed and/or legitimate users are forcibly disconnected from shared editing sessions, undermining integrity and trust in the workspace feature.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	>= 0.6.16, < 0.10.0	`0.10.0`
149.6K 4 dependents Pushed 3d ago 81% patched ~6d to patch Full package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

3.1 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 13% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Unchanged

C None

I Low

A None

What should I do?

1 step

Upgrade Open WebUI to 0.10.0 or later, which enforces authentication on the ydoc:awareness:update and ydoc:document:leave Socket.IO handlers. Until patched, place the Socket.IO endpoint behind network controls (VPN, firewall allow-list, reverse-proxy auth) so it is not reachable by unauthenticated external clients, and disable the collaborative document feature if not actively used. For detection, monitor Socket.IO connection logs for sessions that emit ydoc:* events without a preceding authenticated handshake, and review the vendor advisory (GHSA-gmfw-g93r-vg53) and fix commit (22f2fe1) for handler-level detail if building custom instrumentation.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Framework AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MANAGE 4.1 - Monitor and respond to AI system risks and incidents, including third-party/component risks

Frequently Asked Questions

What is CVE-2026-59715?

Open WebUI's real-time collaborative document editor runs its Socket.IO server with always_connect=True, so the ydoc:awareness:update and ydoc:document:leave event handlers process messages from clients that never completed authentication, letting an unauthenticated party inject fake presence updates or force other users out of a shared document session. The blast radius is narrow — CVSS 3.1 (low), integrity impact limited to collaboration metadata, no confidentiality or availability loss, and EPSS sits at 0.00222 (roughly the top 87th percentile of all scored CVEs, but still a near-negligible absolute exploitation probability) — and there is no public PoC, no Nuclei template, and it is not in CISA KEV. The attack complexity is rated high, meaning an adversary needs specific conditions (network reachability to the collaboration namespace and awareness of the event schema) rather than a trivial one-shot bypass. Open WebUI has a track record of frequent findings (130 other CVEs against the package, risk score 38/100), so treat this as one more entry in an ongoing pattern rather than an isolated one-off. Action: upgrade self-hosted instances to 0.10.0; until patched, restrict network exposure of the Socket.IO/collab endpoint to trusted networks and monitor for socket connections that skip the authenticated handshake.

Is CVE-2026-59715 actively exploited?

No confirmed active exploitation of CVE-2026-59715 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-59715?

Upgrade Open WebUI to 0.10.0 or later, which enforces authentication on the ydoc:awareness:update and ydoc:document:leave Socket.IO handlers. Until patched, place the Socket.IO endpoint behind network controls (VPN, firewall allow-list, reverse-proxy auth) so it is not reachable by unauthenticated external clients, and disable the collaborative document feature if not actively used. For detection, monitor Socket.IO connection logs for sessions that emit ydoc:* events without a preceding authenticated handshake, and review the vendor advisory (GHSA-gmfw-g93r-vg53) and fix commit (22f2fe1) for handler-level detail if building custom instrumentation.

What systems are affected by CVE-2026-59715?

This vulnerability affects the following AI/ML architecture patterns: self-hosted LLM web UI / workspace collaboration layer, real-time collaborative editing (Socket.IO/CRDT) components in AI front-ends.

What is the CVSS score for CVE-2026-59715?

CVE-2026-59715 has a CVSS v3.1 base score of 3.1 (LOW). The EPSS exploitation probability is 0.22%.

What is the AI security impact?

Affected AI Architectures

self-hosted LLM web UI / workspace collaboration layerreal-time collaborative editing (Socket.IO/CRDT) components in AI front-ends

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MANAGE 4.1

What are the technical details?

Original Advisory

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.16 before 0.10.0, the Socket.IO server is configured with always_connect=True. The ydoc:awareness:update and ydoc:document:leave Socket.IO handlers accepted collaborative-document events without requiring an authenticated user, allowing unauthorized manipulation of document collaboration state. This issue is fixed in version 0.10.0.

Exploitation Scenario

An attacker with network access to a self-hosted Open WebUI instance's Socket.IO port connects directly to the collaboration namespace, bypassing the normal authenticated session flow since always_connect=True lets the connection succeed without a validated user context. The attacker then emits crafted ydoc:awareness:update events to spoof presence/cursor data (impersonating another user's activity in a shared document) or sends ydoc:document:leave events to forcibly evict a legitimate collaborator from their active editing session. The result is confusion or disruption within team collaboration on shared AI prompt/notes workspaces — not data theft or system compromise, but enough to undermine trust in the collaboration feature and potentially mask other social-engineering activity (e.g., making it appear a teammate abandoned a shared doc right before a substitution).

Weaknesses (CWE)

CWE-306 Missing Authentication for Critical Function Primary CWE-306 Missing Authentication for Critical Function

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.