CVE-2026-87015: Open WebUI session cookie disclosure in tool servers

CVE-2026-87015 · Severity: medium · CVSS 6.8 · Published 2026-09-09

Open WebUI is a user-friendly interface for AI models that supports connecting to external tool servers for extended functionality. A flaw in how the application handles authentication when multiple tool servers are configured causes user session cookies to be sent to servers that should only receive their own API keys. A malicious or compromised tool server operator could intercept these cookies and impersonate affected users, including administrators, for the lifetime of the session.

Technologies: open-webui (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-87015 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-87015 being exploited in the wild.
How severe is CVE-2026-87015?
Medium severity, with a CVSS score of 6.8, published 9 September 2026.
Which products and versions are affected?
open-webui (PyPI) >= 0.6.27, < 0.11.1, ECOSYSTEM:introduced=0.6.27,fixed=0.11.1.
Is there a fix for CVE-2026-87015?
Yes. open-webui (PyPI): upgrade to 0.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87015 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-87015?
Check whether you run open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • open-webui (PyPI): upgrade to 0.11.1 or later
    pip install "open-webui>=0.11.1"

Technical details

The vulnerability exists in the tool loading routine in `backend/open_webui/utils/tools.py`. When building callables for tool requests across multiple external server connections, the code correctly passes connection-specific headers as a parameter to each callable factory, but leaves the cookie jar as a variable in the enclosing scope. Headers are fixed per connection at factory creation time, but cookies are read only when the tool is invoked—after both loops complete—causing each callable to send the last-assigned cookie jar value regardless of its intended connection. The affected component only assembles cookies for session or system OAuth connections. Exploitation requires two or more tool servers where at least one uses session/system OAuth (processed last) and another uses bearer authentication. When a tool call targets the bearer-authenticated server, it arrives with both the server's expected bearer token and the user's session cookies (`token` and `oauth_session_id`). A tool server operator deliberately configured by an administrator has not chosen to receive user credentials, but the bug treats this as a trusted channel anyway. The fix in v0.11.1 passes each connection's cookie jar as an explicit parameter, mirroring the headers approach, so each request carries only what its own connection was configured to send. No configuration changes are required to benefit from the patch.

Affected products

  • open-webui open-webui >= 0.6.27, < 0.11.1

Identifiers

  • CVE-2026-87015
  • GHSA-p78m-89r6-pgf7
  • PYSEC-2026-4124

Timeline

  • 2026-09-04: disclosed: Advisory published by GitHub
  • 2026-09-10: patched: Fixed in version 0.11.1 via PR #28630
  • 2026-09-09: other: CVE-2026-87015 published by NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.