al-ice.ai

Open WebUI 0.10.0 Closes 18 Newly Disclosed CVEs Across Sessions, Tools, and Files

AI Vulnerabilities & CVEs by al-ice.ai Editorial

Open WebUI operators have a concentrated patching event to process: 18 CVEs published on July 24 all converge on version 0.10.0 as the first fixed release. The set contains six high-, eight medium-, and four low-severity advisories spanning session ownership, tool execution, client-side code isolation, terminal proxying, knowledge permissions, channels, model access, revoked tokens, and denial of service.

The most consequential issue, CVE-2026-59216, let an authenticated low-privilege user route code-interpreter or tool events into another user’s live browser session by supplying that session’s Socket.IO identifier. A shared collaborative note could expose the required identifier. If the victim was an administrator, the advisory’s demonstrated path reached the admin-only Functions API and executed attacker-selected Python as the Open WebUI server process—root in the default container.

This is not a claim that every pre-0.10.0 deployment was remotely exploitable without conditions. Individual advisories have different affected ranges and prerequisites. CVE-2026-59216 required an authenticated attacker, a shared note opened by the victim, enabled code interpretation, and an administrator victim for server-side code execution. The operational conclusion is still direct: inventory the running image, back up the database as the release notes require, and move to 0.10.0 or later.

One user-supplied session key crossed three trust boundaries

The vulnerable event caller checked whether a client-supplied session_id was connected, but not whether that socket belonged to the authenticated requester. That transformed a routing identifier into an authorization credential. Collaboration then supplied discovery: joining a shared note exposed live socket identifiers for participants in the room.

Once an attacker selected a victim socket, execute:python or execute:tool events arrived in the victim’s authenticated browser context. Against an ordinary user, the advisory characterizes this as cross-user tool execution and session compromise. Against an administrator, the browser could call the privileged Functions endpoint, whose intended behavior includes server-side execution of administrator-provided function source.

The 0.10.0 fix binds the target socket to the server-derived authenticated user ID before delivery. That is the right security boundary: connectedness establishes availability, not ownership. Hiding peer socket IDs is useful defense in depth, but an unguessable identifier should never substitute for an authorization decision.

Six high-severity flaws expose recurring agent-platform failure modes

  • CVE-2026-59216: cross-user code-interpreter and tool execution through an unvalidated Socket.IO target session, with a conditional path to server-process code execution through an administrator victim.
  • CVE-2026-59214: stored cross-site scripting through Pyodide. Version 0.10.0 moves client-side Python into a sandboxed, opaque-origin iframe so executed code cannot inherit the application’s origin, cookies, local storage, or same-origin API access.
  • CVE-2026-59221: a terminal-proxy traversal check decoded paths only eight times. A nine-times encoded parent-directory sequence survived normalization and could be decoded by the upstream terminal service after forwarding.
  • CVE-2026-59224: terminal proxy requests forwarded caller-controlled identity data to the upstream, allowing spoofing of X-User-Id and terminal session identifiers before 0.10.0.
  • CVE-2026-59714: attacker-selected message identifiers could cross a channel boundary and overwrite another channel’s message through chat-completion flows.
  • CVE-2026-59219: realtime endpoints could continue accepting JWTs revoked through Redis-backed sign-out or back-channel logout.

The remaining 12 disclosures are not one minor bucket. They include upgrading read-only knowledge-file access into write or delete authority, adding files to a read-only knowledge base, bypassing model access through Arena task endpoints, exposing user data through channel membership, crossing private-channel thread boundaries, bypassing image-edit permissions, weakening web-fetch host filters, unauthenticated collaboration events, account enumeration, and a default-configuration regular-expression denial of service.

The common defect is authority inferred from mutable context

Across the set, several controls trusted an object adjacent to authorization rather than checking the underlying principal-resource relationship. A connected socket was treated like an owned socket. Writable model metadata could convert a readable file reference into write authority. A channel thread’s supplied parent identifier could select content outside the current channel. A terminal proxy forwarded identity claims without integrity-binding them to the authenticated session.

That pattern is especially dangerous in AI interfaces because one product joins many authority domains: user sessions, models, tools, code interpreters, files, knowledge bases, terminals, collaboration rooms, and external services. The assistant is not the only confused deputy available. Browser event buses, metadata records, proxy headers, caches, and background automations can each become a deputy when authorization is inferred rather than re-established at the sink.

The release also changes the security posture of client-side code. Pyodide had been able to run in the application’s origin; 0.10.0 isolates it by default and labels that execution path legacy. This is a durable architectural fix because it removes ambient browser authority rather than trying to recognize every hostile program that a model or user may cause the interpreter to run.

Defensive response checklist

  • Upgrade to 0.10.0 or later. Confirm the actual container digest or installed package version on every replica, worker, and standby. Do not treat a changed deployment manifest as proof that old processes stopped.
  • Back up before migration. The 0.10.0 release notes warn that the update contains database migrations and that downgrading after migration is unsupported. Test restoration and the upgrade on a production-like copy.
  • Expire sessions after rollout. Rotate or invalidate existing web and realtime sessions where practical, especially on shared, multi-user deployments.
  • Review administrator collaboration. Until all instances are patched, do not have administrators open shared notes or untrusted collaborative content. Disable code interpretation and custom tool execution if the business workflow permits.
  • Restrict Functions administration. Treat administrator access to Open WebUI Functions as server code-execution authority. Minimize administrators and investigate unexpected function creation or modification.
  • Audit terminal connectors. Rotate terminal credentials if logs suggest unexpected proxy paths or identity headers. Constrain upstream terminal APIs to intended route prefixes and enforce identity independently at the upstream.
  • Review cross-user activity. Hunt for unusual shared-note joins, tool or Python executions associated with another user’s active session, cross-channel message changes, knowledge-file mutation, and activity after sign-out.
  • Constrain the container anyway. Run the service without root where supported, use a read-only filesystem and narrow volumes, drop Linux capabilities, restrict egress, and separate the Open WebUI process from model and terminal infrastructure.
  • Test authorization at every sink. Add negative tests that vary user, session, channel, model, file, and knowledge-base ownership independently. Object existence, room membership, read access, and possession of an identifier must not imply write or execute permission.

The July 24 advisory batch is a useful map of where an AI workspace’s deterministic security can fail around the model. Open WebUI 0.10.0 repairs the disclosed paths, but the broader engineering lesson is to bind every consequential tool, file, proxy, and realtime action to a server-established principal at the final enforcement point.

That same sink-focused approach applies beyond browser workspaces. Recent coverage of an MCP policy gate that could fail open and an unauthenticated MCP document API shows the recurring problem: model-layer guardrails cannot compensate for missing deterministic authorization in the software that carries out an action.

Sources: