Executive brief
Open WebUI is a user-friendly interface for AI models that supports connecting to external tool servers for extended functionality. A flaw in how the application handles authentication when multiple tool servers are configured causes user session cookies to be sent to servers that should only receive their own API keys. A malicious or compromised tool server operator could intercept these cookies and impersonate affected users, including administrators, for the lifetime of the session.
Technical details
The vulnerability exists in the tool loading routine in `backend/open_webui/utils/tools.py`. When building callables for tool requests across multiple external server connections, the code correctly passes connection-specific headers as a parameter to each callable factory, but leaves the cookie jar as a variable in the enclosing scope. Headers are fixed per connection at factory creation time, but cookies are read only when the tool is invoked—after both loops complete—causing each callable to send the last-assigned cookie jar value regardless of its intended connection. The affected component only assembles cookies for session or system OAuth connections. Exploitation requires two or more tool servers where at least one uses session/system OAuth (processed last) and another uses bearer authentication. When a tool call targets the bearer-authenticated server, it arrives with both the server's expected bearer token and the user's session cookies (`token` and `oauth_session_id`). A tool server operator deliberately configured by an administrator has not chosen to receive user credentials, but the bug treats this as a trusted channel anyway. The fix in v0.11.1 passes each connection's cookie jar as an explicit parameter, mirroring the headers approach, so each request carries only what its own connection was configured to send. No configuration changes are required to benefit from the patch.
Affected products
- open-webui open-webui >= 0.6.27, < 0.11.1
Timeline
- 2026-09-04: disclosed: Advisory published by GitHub
- 2026-09-10: patched: Fixed in version 0.11.1 via PR #28630
- 2026-09-09: other: CVE-2026-87015 published by NVD