CVE-2026-87995: Open WebUI XSS — HIGH

Q: Is CVE-2026-87995 actively exploited?

No confirmed active exploitation of CVE-2026-87995 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-87995?

Upgrade Open WebUI to version 0.11.1 or later immediately, where the iframe sandbox for terminal port previews no longer combines allow-scripts with allow-same-origin. Until patched, disable or tightly restrict access to shared terminal servers, and avoid opening port-preview links from terminal sessions shared with lower-trust users. Detection guidance: review Open WebUI application logs and session tables for anomalous account activity (logins from new IPs/devices, unexpected admin actions) correlated with terminal-preview usage, and audit which users currently have access to shared terminal servers to scope potential exposure prior to patching.

Q: What systems are affected by CVE-2026-87995?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, model serving, multi-tenant AI platforms.

Q: What is the CVSS score for CVE-2026-87995?

CVE-2026-87995 has a CVSS v3.1 base score of 8.7 (HIGH). The EPSS exploitation probability is 0.23%.

CISO Take

Open WebUI's terminal port-preview feature renders forwarded terminal output in an iframe that combines allow-scripts with allow-same-origin, and because that iframe is served from the platform's own origin, any authenticated user on a shared terminal server can host a script on a previewed port and steal the session of anyone who opens the preview. This is a full account-takeover primitive (CVSS 8.7, confidentiality and integrity both High) that requires no special privileges beyond low-level authenticated access and only a single click from the victim, making it realistic in any team or classroom deployment where multiple users share terminal-backed environments inside Open WebUI. There is no evidence of a public exploit, Nuclei template, or CISA KEV listing yet, and EPSS data is unavailable, so this looks like a fresh disclosure rather than an actively exploited bug — but the low complexity and network-reachable attack surface mean that gap will likely close fast. Patch to Open WebUI 0.11.1 or later immediately; until then, restrict or disable shared terminal server access, treat any previewed-port content as untrusted, and review session/audit logs for privilege escalation or unexpected account activity originating from terminal-preview URLs. Because this affects the platform origin itself, any browser extensions or SSO trust relying on the Open WebUI domain should also be reviewed for downstream exposure.

Sources: NVD GitHub Advisory

What is the risk?

High severity (CVSS 8.7) with network attack vector, low attack complexity, and only low privileges required — the main friction is the one required user interaction (opening the preview). No known public exploit code, Nuclei template, or CISA KEV listing exists yet, and EPSS is unavailable, so real-world exploitation likelihood cannot be quantified, but the bug is trivially reproducible for anyone with terminal-server access and the impact (full account takeover, scope-changed to Confidentiality High / Integrity High) is severe. Exposure is highest in multi-tenant Open WebUI deployments (shared teams, classrooms, internal platforms) where multiple users share a terminal server — single-user or fully isolated deployments have a much smaller blast radius since the attacker would need their own low-privilege account plus access to a shared terminal server the victim also uses.

How does the attack unfold?

Initial Access

Attacker with a valid low-privileged Open WebUI account gains access to a shared terminal server also used by the intended victim.

Staging

Attacker hosts a malicious script on an open port within the shared terminal environment and crafts a link to the Open WebUI terminal port-preview feature.

Exploitation

Victim opens the preview link; the misconfigured iframe sandbox (allow-scripts + allow-same-origin) executes the attacker's script in the Open WebUI origin context.

AML.T0047

Impact

The script steals the victim's session/authentication data, giving the attacker full takeover of the victim's Open WebUI account and any connected data or admin privileges.

Initial Access

Attacker with a valid low-privileged Open WebUI account gains access to a shared terminal server also used by the intended victim.

Staging

Attacker hosts a malicious script on an open port within the shared terminal environment and crafts a link to the Open WebUI terminal port-preview feature.

Exploitation

Victim opens the preview link; the misconfigured iframe sandbox (allow-scripts + allow-same-origin) executes the attacker's script in the Open WebUI origin context.

AML.T0047

Impact

The script steals the victim's session/authentication data, giving the attacker full takeover of the victim's Open WebUI account and any connected data or admin privileges.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	>= 0.8.11, <= 0.11.0	`0.11.1`
151.8K 3 dependents Pushed 7d ago 83% patched ~5d to patch Full package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

8.7 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 14% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI Required

S Changed

C High

I High

A None

What should I do?

1 step

Upgrade Open WebUI to version 0.11.1 or later immediately, where the iframe sandbox for terminal port previews no longer combines allow-scripts with allow-same-origin. Until patched, disable or tightly restrict access to shared terminal servers, and avoid opening port-preview links from terminal sessions shared with lower-trust users. Detection guidance: review Open WebUI application logs and session tables for anomalous account activity (logins from new IPs/devices, unexpected admin actions) correlated with terminal-preview usage, and audit which users currently have access to shared terminal servers to scope potential exposure prior to patching.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Framework Plugin AML.T0047 - AI-Enabled Product or Service

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.2 - AI system security controls

NIST AI RMF

MANAGE 2.3 - AI system risks and benefits are regularly monitored based on assessed impacts

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-87995?

Open WebUI's terminal port-preview feature renders forwarded terminal output in an iframe that combines allow-scripts with allow-same-origin, and because that iframe is served from the platform's own origin, any authenticated user on a shared terminal server can host a script on a previewed port and steal the session of anyone who opens the preview. This is a full account-takeover primitive (CVSS 8.7, confidentiality and integrity both High) that requires no special privileges beyond low-level authenticated access and only a single click from the victim, making it realistic in any team or classroom deployment where multiple users share terminal-backed environments inside Open WebUI. There is no evidence of a public exploit, Nuclei template, or CISA KEV listing yet, and EPSS data is unavailable, so this looks like a fresh disclosure rather than an actively exploited bug — but the low complexity and network-reachable attack surface mean that gap will likely close fast. Patch to Open WebUI 0.11.1 or later immediately; until then, restrict or disable shared terminal server access, treat any previewed-port content as untrusted, and review session/audit logs for privilege escalation or unexpected account activity originating from terminal-preview URLs. Because this affects the platform origin itself, any browser extensions or SSO trust relying on the Open WebUI domain should also be reviewed for downstream exposure.

Is CVE-2026-87995 actively exploited?

No confirmed active exploitation of CVE-2026-87995 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-87995?

Upgrade Open WebUI to version 0.11.1 or later immediately, where the iframe sandbox for terminal port previews no longer combines allow-scripts with allow-same-origin. Until patched, disable or tightly restrict access to shared terminal servers, and avoid opening port-preview links from terminal sessions shared with lower-trust users. Detection guidance: review Open WebUI application logs and session tables for anomalous account activity (logins from new IPs/devices, unexpected admin actions) correlated with terminal-preview usage, and audit which users currently have access to shared terminal servers to scope potential exposure prior to patching.

What systems are affected by CVE-2026-87995?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, model serving, multi-tenant AI platforms.

What is the CVSS score for CVE-2026-87995?

CVE-2026-87995 has a CVSS v3.1 base score of 8.7 (HIGH). The EPSS exploitation probability is 0.23%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmodel servingmulti-tenant AI platforms

MITRE ATLAS Techniques

AML.T0047 AI-Enabled Product or Service

Compliance Controls Affected

ISO 42001: A.6.2.2

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin. Because the terminal proxy serves that content from the Open WebUI origin, an authenticated user with access to a shared terminal server could host script on a previewed port and take over a victim's account when the victim opened the preview. This issue is fixed in version 0.11.1.

Exploitation Scenario

An attacker with a valid but low-privileged Open WebUI account gains access to a shared terminal server used by other authenticated users (common in team or classroom self-hosted deployments). They start a process on that terminal that serves a small web page containing malicious JavaScript on an open port, then send the victim a link to preview that port through Open WebUI's built-in terminal port-preview feature. When the victim — an authenticated user, potentially an admin — opens the preview, the malicious script executes inside an iframe that is both scriptable and same-origin with the main Open WebUI application, letting it read the victim's session/auth tokens and perform actions as that user, resulting in account takeover.

Weaknesses (CWE)

CWE-1021 Improper Restriction of Rendered UI Layers or Frames Primary CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Primary CWE-1021 Improper Restriction of Rendered UI Layers or Frames CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-1021 — Improper Restriction of Rendered UI Layers or Frames: The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

[Implementation] The use of X-Frame-Options allows developers of web content to restrict the usage of their application within the form of overlays, frames, or iFrames. The developer can indicate from which domains can frame the content. The concept of X-Frame-Options is well documented, but implementation of this protection mechanism is in development to cover gaps. There is a need for allowing frames from multiple domains.
[Implementation] A developer can use a "frame-breaker" script in each page that should not be framed. This is very helpful for legacy browsers that do not support X-Frame-Options security feature previously mentioned. It is also important to note that this tactic has been circumvented or bypassed. Improper usage of frames can persist in the web application through nested frames. The "frame-breaking" script does not intuitively account for multiple nested frames that can be presented to the user.

Source: MITRE CWE corpus.