CVE-2026-59216: Open WebUI code execution via unvalidated Socket.IO session ID

CVE-2026-59216 · Severity: high · CVSS 7.7 · Published 2026-07-09

Open WebUI is a user interface for interacting with large language models. A security flaw allows a logged-in user to hijack another user's session and execute commands or tools as if they were that person. If an attacker targets an administrator, they can gain full control over the server, potentially leading to data theft or complete system compromise.

Technologies: open-webui (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-59216 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59216 being exploited in the wild.
How severe is CVE-2026-59216?
High severity, with a CVSS score of 7.7, published 9 July 2026.
Which products and versions are affected?
open-webui (PyPI) < 0.10.0, ECOSYSTEM:introduced=0,fixed=0.10.0.
Is there a fix for CVE-2026-59216?
Yes. open-webui (PyPI): upgrade to 0.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59216 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-59216?
Check whether you run open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • open-webui (PyPI): upgrade to 0.10.0 or later
    pip install "open-webui>=0.10.0"

Technical details

The vulnerability exists in the Socket.IO event-caller ('get_event_call') within 'backend/open_webui/socket/main.py'. The component delivers 'execute:python' and 'execute:tool' events to a client-supplied 'session_id' without verifying if the session belongs to the requesting user. An attacker can obtain a victim's 'session_id' via the 'ydoc:document:join' event in shared notes. By sending a crafted request to '/api/v1/chat/completions' with the victim's session ID, the attacker can execute arbitrary Python code in the victim's browser context. If the victim is an administrator, the attacker can leverage the admin-only Functions API to achieve server-side remote code execution (RCE) as the root user. This has been patched in version 0.10.0 by implementing ownership checks on session IDs.

Affected products

  • Open WebUI open-webui < 0.10.0

Identifiers

  • CVE-2026-59216
  • GHSA-74h3-cxq7-vc5q
  • PYSEC-2026-3592

Timeline

  • 2026-07-02: disclosed
  • 2026-07-09: advisory: NVD publication
  • 2026-07-24: patched: GitHub Advisory published/updated with patch details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.