CVE-2026-87015 Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication
Open WebUI leaks user session cookies to external tool servers, allowing operators to hijack accounts if bearer authentication is configured.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-87015?
CVE-2026-87015 is a medium-severity vulnerability in Openwebui Open Webui, published on 9 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached and a session or system OAuth connection was processed last, a request to a different server configured for bearer authentication could include the calling user's Open WebUI session cookies, allowing that server's operator to reuse the session and take over the account. This issue is fixed in version 0.11.1.
Weakness: CWE-201
Which versions are affected by CVE-2026-87015?
3 open source packages ship an affected version, including open-webui. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
open-webui PyPI | From 0.6.27 | 0.11.1 |
open-webui PyPI | From 0.6.27 | 0.11.1 |
open-webui PyPI | From 0.6.27 | 0.11.1 |
Products include Openwebui Open Webui.
How do I fix CVE-2026-87015?
Upgrade open-webui to 0.11.1 or later.
Is CVE-2026-87015 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-87015 exists.
Other vulnerabilities in Openwebui Open Webui
- CVE-2026-44551 Open WebUI: LDAP Empty Password Authentication Bypass
- CVE-2026-56400 open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation
- CVE-2024-8017 Cross-site Scripting (XSS) in open-webui/open-webui
- CVE-2026-45672 Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed
- CVE-2026-87995 Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
Sources
Also known as GHSA-p78m-89r6-pgf7, PYSEC-2026-4124.