The Cookie Jar Goes to the Tool Server: Open WebUI’s Five-CVE 0.11.4 Batch Hands Your Authority to Everyone It Talks To

2026-10-14 AI Vulnerabilities & CVEs by al-ice.ai Editorial

On 12 October 2026, NVD published five CVE records against Open WebUI — the self-hosted LLM frontend that sits between users, model providers, tool servers, and terminal servers — all fixed in 0.11.4. (Open WebUI has been here before: its 0.10.0 release closed 18 CVEs across sessions, tools, and files in July.) Four landed at 17:17Z and the fifth at 23:17Z, all assigned through GitHub’s CNA, and one researcher, Classic298, is credited on every single one. Read together they describe one architectural habit, not five unrelated mistakes: Open WebUI routinely acts with your authority toward parties that should never hold it. Your browser cookies go to third-party servers. Your admin terminal key goes to every terminal user. Your configured provider API keys go wherever an authenticated user points an index. Your event loop goes to whatever regex the model was told to run.

The session cookie went along for the ride

The headliner is CVE-2026-109292 (CWE-200, 6.8 medium on CVSS 3.1, 7.6 high on CVSS 4.0), affecting everything from 0.6.27 to 0.11.4. On OAuth-mode connections, Open WebUI forwarded the user’s full browser cookie jar to the destination server. Operators of OpenAI-compatible connections, OpenAPI tool servers, or terminal servers could capture forwarded session cookies from routine requests and replay them to hijack accounts — including administrators. The tool server you added so the model could call an API was handed the keys to your login session as a matter of course. It is the same trust error that put LiteLLM’s MCP auth bypass into CISA’s KEV catalog: the gateway treats the downstream server as inside the trust boundary when it is, by design, outside it.

The fix, read first-hand in three commits by maintainer Timothy Jaeryang Baek on 7 September (3cda47c, b71744b, f9f815c), tells the story by inversion. It adds a forward_cookies: bool = False field to both ToolServerConnection and TerminalServerConnection, and rewrites four call sites — get_headers_and_cookies in routers/openai.py, proxy_terminal in routers/terminals.py, build_tool_server_headers and get_terminal_tools in utils/tools.py — so that request.cookies is attached only when the connection explicitly opts in. Before the fix, the session and system_oauth auth branches set cookies = request.cookies unconditionally. The secure default the fix introduces — don’t send cookies anywhere unless asked — is the sentence the original code was missing. Credits on the record: gigioneggiando, brodmart, and Classic298.

The terminal proxy carried the admin key

CVE-2026-109572 (CWE-862, 7.6 high / 7.2 high, affecting 0.8.6 to 0.11.4) is the privilege escalation in the batch, and the most agent-relevant. Authenticated users could reach the Terminals administrator API through the terminal proxy at /api/v1/terminals/{server_id}/{path} with the shared key attached — listing or stopping other users’ terminals and modifying terminal policies, including injecting environment variables into other users’ terminals. A proxy whose job is to let you use your terminal let you administer everyone’s.

The fix commit (51bb8cb, 12 September) is fourteen added lines in routers/terminals.py and does three things at once: it defines ADMIN_API_PATHS = ('api/v1/policies', 'api/v1/status', 'api/v1/terminals') and returns 403 when the proxied path resolves under any of them relative to the configured server root; it sets allow_redirects=False on the upstream request so a malicious terminal server can’t bounce the proxied request — shared key included — somewhere else; and it extends the path sanitizer to reject tabs and newlines, noting that URL parsers strip them and can turn .\t. into ... Three distinct bypass primitives closed in one commit is a sign the proxy had never been treated as a security boundary. Credits: dhlife09, Classic298, ye11oc4t, jiwhan8655, Dog-Parka.

The disabled backend was one index away

CVE-2026-109296 (CWE-639, 4.3 medium / 5.3 medium, all versions before 0.11.4) is the quiet one. Any authenticated user could reach disabled model provider backends by supplying an explicit backend index as a path segment or query parameter on the Ollama and OpenAI-compatible listing routes — triggering outbound requests that carry configured API keys, reading version strings, and enumerating connections. Disabling a backend removed it from the UI, not from the routing table, and the requests the frontend issued on the user’s behalf carried the deployment’s own provider credentials. Notably, the NVD record carries advisory-only references — no patch commit is cited — so the exact server-side correction is less transparent than the other four. Credit: ahkarl13 and Classic298.

The model runs the regex you hand it, on your event loop

The remaining pair lives in the model-invoked grep tools and is the clearest prompt-to-DoS path in the batch. CVE-2026-109295 (CWE-1333, 6.5 medium / 7.1 high, 0.11.0–0.11.4) lets an authenticated user stall server workers by having the model call grep_knowledge_files or grep_chat_files with a catastrophically backtracking regex — about two seconds of blocked event loop per call, repeatable. CVE-2026-109298 (CWE-400, 6.5 medium / 7.1 high, same range) is the compile-time sibling: short nested counted-repetition patterns expand unbounded during compilation with the regex engine, and the result is cached — blocking the loop and exhausting worker memory. Credits: yousif-IQ and baeseungwon1010 respectively, both with Classic298.

The fix for the second (97e013a, 21 September, the day 0.11.4 shipped) is the kind of diff worth quoting. It deletes the hand-rolled validate_regex_quantifiers validator — along with its comment admitting that “backtracking cost is exponential in the length of the matched text, so capping the pattern or the line does not bound it” — and replaces the engine itself: import regex becomes import re2, compiled programs and match cache are capped at 1 MiB, patterns are length-capped at 4,096 characters, and the tool docstrings now tell the model that “regex uses RE2 syntax; no lookarounds/backreferences.” The team knew the denylist-style cap couldn’t bound the cost, shipped the cap anyway, then fixed it properly by switching to a linear-time engine. That arc — from “validate the input” to “change what the input runs on” — is the correct lesson, and it is the same one Roo Code’s five approval bypasses teach from the other side: a guard downstream of a parser whose failures you have not enumerated will always have holes a grammar would have caught.

What to do, and what this batch is really about

Upgrade to 0.11.4 or later; every record in the batch names it as the fixed version, and the fixes landed between 7 and 21 September, so 0.11.4 (tagged 21 September) is the first release containing all of them. After upgrading, audit every configured tool-server, OpenAPI, and terminal connection for the new forward_cookies flag — it defaults to off, and anything you turn back on re-exposes the 109292 path. Rotate session cookies and admin tokens on instances that ever ran an affected version with third-party connections configured, since cookie capture leaves no server-side trace. And treat the grep-tool pair as a reminder that any tool the model can invoke with attacker-influenced arguments is unauthenticated input to your infrastructure, regardless of who is logged in.

The through-line is worth stating plainly. Each of these bugs is a place where the frontend spent the user’s authority on someone else’s behalf: cookies to tool operators, the admin terminal key to terminal users, provider API keys to anyone naming an index, compute to any pattern the model repeats. Open WebUI is infrastructure that brokers trust between four parties — user, provider, tool server, model — and this batch shows what happens when the broker is generous by default. The fixes all move in the same direction: default-deny forwarding, explicit path blocks, a linear-time engine. Generosity was the vulnerability; the patch is parsimony.

All five CVE descriptions, scores, affected ranges, and researcher credits above are taken first-hand from the NVD 2.0 records (four Received, one Awaiting Analysis at time of writing) and the linked VulnCheck advisories; the fix mechanics are read directly from the cited upstream commits. The synthesis — that the batch shares a single ambient-authority habit — is our editorial analysis. We have no evidence of in-the-wild exploitation for any of these five and imply none.

Sources: