CVE-2026-87015

Open WebUI, a widely deployed self-hosted AI platform, leaks the calling user's session cookies to external tool servers in versions 0.6.27 through before 0.11.1 due to a closure bug in backend/open_webui/utils/tools.py that captures a shared cookie jar from the enclosing connection loop instead of binding it per tool callable. The flaw is triggered when an instance has multiple external tool servers attached and a session or system OAuth connection is processed last, after which requests to a different server configured for bearer authentication carry the user's Open WebUI session cookies. A malicious or compromised tool server operator receiving those cookies can replay them to fully take over the victim's account (high confidentiality and integrity impact, no availability impact), though exploitation requires user interaction and a fairly specific configuration (AC:H, UI:R). Affected deployments are self-hosted Open WebUI instances running the vulnerable pip/Docker versions with multiple tool servers using mixed authentication. No exploitation in the wild is known; only the coordinated GitHub security advisory (GHSA-p78m-89r6-pgf7) is public, and EPSS sits at a very low 0.3%.

What to do: Upgrade Open WebUI to version 0.11.1 or later immediately. Audit instances for attached external tool/MCP servers and identify any using bearer authentication alongside OAuth-connected servers, treating those server operators as potentially having intercepted session cookies. If such a configuration existed on a vulnerable version, invalidate all user sessions/force re-login and rotate credentials, then review logs for unexpected session reuse.