Executive brief
Open WebUI is a user interface for interacting with large language models. A security flaw allows a logged-in user to hijack another user's session and execute commands or tools as if they were that person. If an attacker targets an administrator, they can gain full control over the server, potentially leading to data theft or complete system compromise.
Technical details
The vulnerability exists in the Socket.IO event-caller ('get_event_call') within 'backend/open_webui/socket/main.py'. The component delivers 'execute:python' and 'execute:tool' events to a client-supplied 'session_id' without verifying if the session belongs to the requesting user. An attacker can obtain a victim's 'session_id' via the 'ydoc:document:join' event in shared notes. By sending a crafted request to '/api/v1/chat/completions' with the victim's session ID, the attacker can execute arbitrary Python code in the victim's browser context. If the victim is an administrator, the attacker can leverage the admin-only Functions API to achieve server-side remote code execution (RCE) as the root user. This has been patched in version 0.10.0 by implementing ownership checks on session IDs.
Affected products
- Open WebUI open-webui < 0.10.0
Timeline
- 2026-07-02: disclosed
- 2026-07-09: advisory: NVD publication
- 2026-07-24: patched: GitHub Advisory published/updated with patch details