CVE-2026-87015: Open WebUI session cookies leak to

Q: Is CVE-2026-87015 actively exploited?

No confirmed active exploitation of CVE-2026-87015 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-87015?

Upgrade the open-webui pip package to 0.11.1 or later immediately — this is the fix commit referenced in GHSA-p78m-89r6-pgf7 and PR #28630. Until patched, avoid attaching bearer-token-authenticated tool servers and OAuth/session-authenticated tool servers to the same Open WebUI instance; if mixed auth is unavoidable, isolate tool servers per trust tier or per user. Audit which tool servers are currently configured and remove any operated by unverified or low-trust third parties. After patching, rotate active user sessions to invalidate any cookies that may have already leaked, and review tool-server access logs for unexpected Open WebUI session cookie values in incoming requests as an indicator of prior exploitation. Restrict tool-server configuration privileges to trusted admins only.

Q: What systems are affected by CVE-2026-87015?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, tool-calling / plugin architectures, self-hosted AI platforms, multi-tenant chat deployments.

Q: What is the CVSS score for CVE-2026-87015?

CVE-2026-87015 has a CVSS v3.1 base score of 6.8 (MEDIUM). The EPSS exploitation probability is 0.29%.

CISO Take

Open WebUI, an open-source self-hosted AI platform, shipped a session-hijacking bug: the code that forwards authentication to external "tool servers" reused a single cookie jar across all outbound connections instead of scoping credentials per external call, so a user's Open WebUI session cookies could leak to an unrelated bearer-auth tool server whenever that server's request was processed after an OAuth-connected one in the same session. Any deployment that lets users or admins attach multiple third-party tool servers with mixed authentication modes is exposed to full account takeover by a malicious or compromised tool server operator — the CVSS vector shows high confidentiality and integrity impact (C:H/I:H) with no availability loss. Attack complexity is high and requires user interaction plus a specific tool-server processing order, and there is no evidence of active exploitation, no public PoC, no Nuclei template, and it is not in CISA KEV, so this is a real but not imminent risk. Patch to Open WebUI 0.11.1 immediately; until then, do not mix OAuth/session-authenticated tool servers with bearer-token tool servers in the same instance and treat every third-party tool server as untrusted infrastructure.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium severity (CVSS 6.8) driven by a high-impact outcome (full session takeover, C:H/I:H) offset by high attack complexity and a required user-interaction step. There is no known public exploit code, no Nuclei detection template, and the CVE is absent from CISA KEV and has no EPSS score, indicating exploitation has not been observed in the wild. Real-world exploitability depends heavily on deployment topology: single-user, single-tool-server instances are effectively unaffected, while multi-tenant or agentic deployments that attach several tool servers with mixed auth types (OAuth/session plus bearer token) carry meaningful risk from any tool server operator who is malicious or whose infrastructure is compromised. The package itself has a track record of frequent security findings (168 other CVEs on record) and a moderate risk score (38/100), reflecting the pace of change in a fast-moving open-source project rather than unusual danger from this specific flaw alone.

How does the attack unfold?

Malicious tool server setup

Attacker stands up or controls a tool server configured for bearer-token authentication and gets it attached alongside an OAuth/session-authenticated tool server on a shared Open WebUI instance.

Cookie jar leakage

A victim's tool call triggers Open WebUI's shared cookie jar bug, causing the user's session cookies to be attached to the outbound request sent to the attacker's bearer-auth tool server.

AML.T0098

Credential harvesting

The attacker captures the leaked Open WebUI session cookie from their tool server's incoming request logs.

AML.T0053

Account takeover

Attacker replays the stolen session cookie against Open WebUI to impersonate the victim and access their account, chat history, and connected data.

AML.T0091.000

Malicious tool server setup

Attacker stands up or controls a tool server configured for bearer-token authentication and gets it attached alongside an OAuth/session-authenticated tool server on a shared Open WebUI instance.

Cookie jar leakage

A victim's tool call triggers Open WebUI's shared cookie jar bug, causing the user's session cookies to be attached to the outbound request sent to the attacker's bearer-auth tool server.

AML.T0098

Credential harvesting

The attacker captures the leaked Open WebUI session cookie from their tool server's incoming request logs.

AML.T0053

Account takeover

Attacker replays the stolen session cookie against Open WebUI to impersonate the victim and access their account, chat history, and connected data.

AML.T0091.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	>= 0.6.27, < 0.11.1	`0.11.1`
151.8K 3 dependents Pushed 7d ago 83% patched ~5d to patch Full package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

6.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC High

PR None

UI Required

S Unchanged

C High

I High

A None

What should I do?

1 step

Upgrade the open-webui pip package to 0.11.1 or later immediately — this is the fix commit referenced in GHSA-p78m-89r6-pgf7 and PR #28630. Until patched, avoid attaching bearer-token-authenticated tool servers and OAuth/session-authenticated tool servers to the same Open WebUI instance; if mixed auth is unavoidable, isolate tool servers per trust tier or per user. Audit which tool servers are currently configured and remove any operated by unverified or low-trust third parties. After patching, rotate active user sessions to invalidate any cookies that may have already leaked, and review tool-server access logs for unexpected Open WebUI session cookie values in incoming requests as an indicator of prior exploitation. Restrict tool-server configuration privileges to trusted admins only.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent Plugin API AML.T0053 - AI Agent Tool Invocation AML.T0091.000 - Application Access Token AML.T0098 - AI Agent Tool Credential Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2 - AI system operation and monitoring

NIST AI RMF

MAP-5.1 - Third-party and integrated component risk

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-87015?

Open WebUI, an open-source self-hosted AI platform, shipped a session-hijacking bug: the code that forwards authentication to external "tool servers" reused a single cookie jar across all outbound connections instead of scoping credentials per external call, so a user's Open WebUI session cookies could leak to an unrelated bearer-auth tool server whenever that server's request was processed after an OAuth-connected one in the same session. Any deployment that lets users or admins attach multiple third-party tool servers with mixed authentication modes is exposed to full account takeover by a malicious or compromised tool server operator — the CVSS vector shows high confidentiality and integrity impact (C:H/I:H) with no availability loss. Attack complexity is high and requires user interaction plus a specific tool-server processing order, and there is no evidence of active exploitation, no public PoC, no Nuclei template, and it is not in CISA KEV, so this is a real but not imminent risk. Patch to Open WebUI 0.11.1 immediately; until then, do not mix OAuth/session-authenticated tool servers with bearer-token tool servers in the same instance and treat every third-party tool server as untrusted infrastructure.

Is CVE-2026-87015 actively exploited?

No confirmed active exploitation of CVE-2026-87015 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-87015?

Upgrade the open-webui pip package to 0.11.1 or later immediately — this is the fix commit referenced in GHSA-p78m-89r6-pgf7 and PR #28630. Until patched, avoid attaching bearer-token-authenticated tool servers and OAuth/session-authenticated tool servers to the same Open WebUI instance; if mixed auth is unavoidable, isolate tool servers per trust tier or per user. Audit which tool servers are currently configured and remove any operated by unverified or low-trust third parties. After patching, rotate active user sessions to invalidate any cookies that may have already leaked, and review tool-server access logs for unexpected Open WebUI session cookie values in incoming requests as an indicator of prior exploitation. Restrict tool-server configuration privileges to trusted admins only.

What systems are affected by CVE-2026-87015?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, tool-calling / plugin architectures, self-hosted AI platforms, multi-tenant chat deployments.

What is the CVSS score for CVE-2026-87015?

CVE-2026-87015 has a CVSS v3.1 base score of 6.8 (MEDIUM). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

agent frameworkstool-calling / plugin architecturesself-hosted AI platformsmulti-tenant chat deployments

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0091.000 Application Access Token

AML.T0098 AI Agent Tool Credential Harvesting

Compliance Controls Affected

ISO 42001: A.6.2

NIST AI RMF: MAP-5.1

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached and a session or system OAuth connection was processed last, a request to a different server configured for bearer authentication could include the calling user's Open WebUI session cookies, allowing that server's operator to reuse the session and take over the account. This issue is fixed in version 0.11.1.

Exploitation Scenario

An attacker stands up or gains control of a tool server and registers it with an Open WebUI deployment configured for bearer-token authentication, alongside a legitimate tool server that uses session or system OAuth. When a victim user's request flow processes the OAuth-connected tool server last in the loop, a subsequent call to the attacker's bearer-auth tool server carries the victim's Open WebUI session cookie in the outbound request due to the shared cookie jar bug. The attacker harvests the leaked session cookie from their own server's access logs or middleware, then replays it against the victim's Open WebUI instance to impersonate the user — gaining access to their chat history, connected data sources, and any credentials or API keys reachable from that account, all without needing the victim's password.

Weaknesses (CWE)

CWE-201 Insertion of Sensitive Information Into Sent Data Primary CWE-201 Insertion of Sensitive Information Into Sent Data

CWE-201 — Insertion of Sensitive Information Into Sent Data: The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

[Requirements] Specify which data in the software should be regarded as sensitive. Consider which types of users should have access to which types of data.
[Implementation] Ensure that any possibly sensitive data specified in the requirements is verified with designers to ensure that it is either a calculated risk or mitigated elsewhere. Any information that is not necessary to the functionality should be removed in order to lower both the overhead and the possibility of security sensitive data being sent.

Source: MITRE CWE corpus.