OPEN-WEBUI · CVE-2026-109292 · AI agents & MCP
FIX → 0.11.4
Open WebUI sent the full browser cookie jar, including its own session cookie, to OpenAI-compatible connections, OpenAPI tool servers and terminal servers set to the OAuth authentication mode. The receiving server can replay that cookie to log in as the user, with admin access if the user is an administrator.
first public Sep 27, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only deployments that have at least one OpenAI-compatible connection, OpenAPI tool server or terminal server configured with the "OAuth" authentication mode are exposed. Every user whose requests reach such a connection leaks a live session cookie to that destination, whether or not they configured it. Connections default to bearer authentication, and MCP tool servers and "Session" mode connections are not affected.
Not affected if default-config, mcp-only, no-oauth-mode-connections, session-auth-mode
Who cares open-webui, openai-compatible, self-hosted, terminal-server, tool-servers
pip show open-webui; versions from 0.6.27 up to but not including 0.11.4 are affected.Upgrade to 0.11.4
An OpenAI-compatible connection, OpenAPI tool server or terminal server configured with the "OAuth" authentication mode sent the full browser cookie jar of the requesting user to its destination, including Open WebUI's own session cookie. The mode is documented to the administrator as forwarding only the user's OAuth access token. Every user whose request reached such a connection disclosed a live session credential to the destination, whether or not they were the administrator who configured it and whether or not an OAuth token was present.
An administrator has configured at least one OpenAI-compatible connection, OpenAPI tool server or terminal server with the "OAuth" authentication mode. Connections default to bearer authentication, so this mode is never active out of the box. No OAuth provider needs to be configured or return a token; the cookies were sent regardless. The destination only needs to observe the incoming Cookie header, which ordinary request logging does. Not affected: connections using the "Session" authentication mode, whose forwarding of session credentials is documented, and MCP tool servers, which never received cookies.
The operator of the destination receives the Open WebUI session cookie of every verified user whose request reaches it, including through routine calls such as the model list fetched on page load, with no action from the user beyond ordinary use. Replaying that cookie against the instance authenticates as that user for the lifetime of the token, which gives the destination full access to the account and administrative access where the user is an administrator. The destination is a server an administrator registered for OAuth authentication, a configuration that implied sending it only the OAuth access token.
Fixed in 0.11.4 by https://github.com/open-webui/open-webui/commit/f9f815c86220f809fad5ee1300c44f55dea74c79 (OpenAI-compatible connections), (terminal servers) and (tool servers and terminal tools). Forwarding the cookie jar is now a separate per-connection setting that is off by default, so the OAuth mode sends only the OAuth access token in the Authorization header. Upgrading resolves the issue with no configuration change.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
open-webui 0.11.4 (fixed version; the advisory says upgrading needs no configuration change).Affected component: the outbound header and cookie builder for OpenAI-compatible connections, the builder for OpenAPI tool servers and terminal tools, and the terminal server proxy. Affected setup: any deployment with a connection, tool server or terminal server set to the "OAuth" authentication mode.
When the OAuth mode was added, its branch copied the cookie line from the neighbouring "Session" branch unchanged, so the whole inbound cookie jar was attached to the outbound request before, and independently of, the OAuth token lookup. The forwarded cookies were never narrowed to what the mode is documented to send. Because each outbound call carries the requesting user's own cookies, the disclosed session belongs to whichever user triggered the call.
Reproduced by the reporter against a running 0.11.2 instance. An OpenAI-compatible connection was registered with a request-capturing destination and the "OAuth" authentication mode. A model list request authenticated only by the session cookie triggered the outbound call. The destination received the full cookie jar, including the session cookie, and no OAuth token. Replaying the captured cookie against the instance returned an authenticated response as the affected account.
Confirmed during triage by running the connection header builder from 0.11.3 and 0.11.4 with the same session cookies and no OAuth token: 0.11.3 attaches the session cookie to the outbound request, and 0.11.4 attaches no cookies.
@gigioneggiando @brodmart
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.