OPEN-WEBUI · CVE-2026-109572 · Package
FIX → 0.11.4
Open WebUI's terminal proxy forwarded any requested path to the Terminals orchestrator with the administrator's shared key attached, so a regular user with terminal access could read and change terminal policies and stop other users' terminals. An attacker can also set environment variables that appear in another user's terminal when it next starts.
first public Sep 28, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only deployments that run Open WebUI from 0.8.6 through 0.11.3 with a Terminals connection configured are exposed. Deployments without a Terminals connection, or with connections pinned to a named policy, are not reached through this path. Teams can skip it if they do not use Terminals.
Not affected if no-terminals-connection, open-webui-0.11.4-or-later, pinned-policy-connection
Who cares open-webui, python, self-hosted, terminals
pip show open-webui or the image tag; affected builds are 0.8.6 through 0.11.3.0.2.4.A regular user who has been given access to a Terminals connection could send requests through Open WebUI's terminal proxy to the Terminals administrator API. Open WebUI forwarded any requested path and attached the administrator-configured shared key, so Terminals treated the request as an administrator request. The user could read and change terminal policies and list and stop other users' terminals, without ever seeing the key.
Under the preconditions above the attack needs one authenticated request per action and no interaction from anyone else. The attacker could list all active terminals with their owners' user ids, policy, instance name, host, port and activity; stop another user's running terminal; read the Terminals status and configuration; and create and change terminal policies. Changing a policy was observed to take effect on other users: environment variables set by the attacker appeared in a second user's terminal when it next started on a connection pinned to that policy. Stopped terminals are started again on the next access. Open WebUI's own data is not exposed through this path.
Fixed in 51bb8cb142f72503e861eeee25ae4dc73c26c36b, released in 0.11.4. The terminal proxy now refuses to forward requests to the Terminals administrator paths (policies, status and terminal lifecycle). Terminals 0.2.4 additionally rejects administrator requests that arrive on behalf of a user.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 0.11.4
0.11.4 (fixed in commit 51bb8cb142f72503e861eeee25ae4dc73c26c36b).0.2.4 or later, which rejects administrator requests that carry a user identity.backend/open_webui/routers/terminals.py, the /api/v1/terminals/{server_id}/{path} proxy.The proxy was built to let users reach their own terminal through the orchestrator, and it forwarded whatever path the user asked for with the server's shared key attached. Terminals protects its administrator API with that same key, so the proxy never separated user traffic from administrator traffic and a user could choose an administrator path.
Tested against Terminals 0.2.3 with the Docker backend and a bearer connection using the shared key, with two ordinary users. A direct request to Terminals without the key returns 401. Through Open WebUI 0.11.3, using only the attacker's own session:
GET /api/v1/terminals/<server_id>/api/v1/policies -> 200
PUT /api/v1/terminals/<server_id>/api/v1/policies/poc-low-user -> 200, policy created
GET /api/v1/terminals/<server_id>/api/v1/terminals -> 200, lists the victim's terminal
POST /api/v1/terminals/<server_id>/api/v1/terminals/stop
{"user_id":"<victim>","policy_id":"default","context_id":"default"}
-> 200 {"matched":1,"stopped":1,"skipped_active":0}
The victim's terminal container was removed. Rewriting a policy with an env value and then having a second user open a connection pinned to that policy started a container carrying the attacker's value. On 0.11.4 every request above returns 403. The proxy was exercised directly with the connection configuration and user identity supplied by the test harness.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.