CVE-2026-109289: Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket

Q: Who is exposed to this issue?

Deployments running Open WebUI versions from 0.8.8 through versions before 0.11.4 are affected when a user has an already open terminal WebSocket. The user must previously have had access to the terminal functionality.

Q: What does an attacker need to exploit it?

An attacker needs a terminal WebSocket established while their account is active. After the account is deactivated, they can continue using that existing connection without reauthorization.

Q: What can a deactivated user do through the retained connection?

They can continue executing terminal commands and reading or writing files on the terminal server through the already open WebSocket.

Q: What should be done if the user account has already been deactivated?

The affected existing terminal WebSocket connection must be terminated to stop continued terminal access. Upgrading to version 0.11.4 or later addresses the affected version range.

Published Oct 12, 2026

Updated

Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through an already open terminal WebSocket. Because the terminal proxy route in terminals.py checks access only on the first message, deactivated users can keep running commands and reading or writing files on the terminal server.

Affected Software

1 affected component

Open WebUI Open WebUI>=0.8.8<0.11.4

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Deployments running Open WebUI versions from 0.8.8 through versions before 0.11.4 are affected when a user has an already open terminal WebSocket. The user must previously have had access to the terminal functionality.

What does an attacker need to exploit it?

An attacker needs a terminal WebSocket established while their account is active. After the account is deactivated, they can continue using that existing connection without reauthorization.

What can a deactivated user do through the retained connection?

They can continue executing terminal commands and reading or writing files on the terminal server through the already open WebSocket.

What should be done if the user account has already been deactivated?

The affected existing terminal WebSocket connection must be terminated to stop continued terminal access. Upgrading to version 0.11.4 or later addresses the affected version range.

CVE-2026-109289: Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can a deactivated user do through the retained connection?

What should be done if the user account has already been deactivated?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can a deactivated user do through the retained connection?

What should be done if the user account has already been deactivated?