CVE-2026-109289 Overview
CVE-2026-109289 is an improper authorization vulnerability in Open WebUI versions 0.8.8 through 0.11.4. The flaw resides in the terminal proxy route defined in terminals.py, which validates user access only on the first WebSocket message. Deactivated users retain active terminal sessions and continue executing commands against the terminal server. Attackers with revoked accounts can read and write files or run arbitrary commands long after their access should have been terminated. The weakness is classified as [CWE-613] Insufficient Session Expiration.
Critical Impact
Deactivated Open WebUI users keep executing terminal commands through existing WebSocket connections, enabling unauthorized file access and command execution on the terminal server.
Affected Products
- Open WebUI version 0.8.8 and later
- Open WebUI versions prior to 0.11.4
- Deployments exposing the terminal proxy route in terminals.py
Discovery Timeline
- 2026-10-12 - CVE-2026-109289 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-109289
Vulnerability Analysis
Open WebUI exposes an interactive terminal feature through a WebSocket proxy. The proxy route in terminals.py evaluates the user's authorization state only when the WebSocket connection is first established. Once the socket is open, subsequent messages are forwarded to the backend terminal server without re-validating whether the account remains active.
An administrator can deactivate a user account to revoke access. However, if that user already has an open terminal session, the deactivation does not terminate the WebSocket. The deactivated principal keeps sending commands over the persistent channel.
The vulnerability maps to [CWE-613] Insufficient Session Expiration. Account state transitions are not propagated to active sessions, which breaks the authorization boundary the administrator expects.
Root Cause
The root cause is a one-time access check at the WebSocket handshake. Open WebUI does not re-authorize each inbound message against the current user state, and it does not force disconnect sessions when an account is deactivated. Session lifetime is bound to the socket, not to the account's authorization status.
Attack Vector
An authenticated user opens a terminal in Open WebUI, which creates a persistent WebSocket to the terminal proxy. An administrator later deactivates that account. The attacker continues sending commands through the existing WebSocket to read files, write files, or execute arbitrary shell commands on the terminal server. Exploitation requires low privileges and no user interaction, but the attacker must have an open session at the time of deactivation.
See the GitHub Security Advisory GHSA-6g45-8g27-fh8q and the VulnCheck Advisory for Open WebUI for additional technical context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-109289
Indicators of Compromise
- Terminal WebSocket connections that remain open after the associated user account has been set to deactivated in the Open WebUI admin panel.
- Shell command execution, file read, or file write events on the terminal server originating from accounts flagged as inactive.
- Audit log entries showing terminal activity timestamps that post-date the account deactivation timestamp.
Detection Strategies
- Correlate the Open WebUI user state table with active WebSocket sessions and alert when deactivated users still hold open /terminals connections.
- Inspect reverse proxy or load balancer logs for long-lived WebSocket upgrades to the terminal endpoint associated with disabled identities.
- Baseline normal terminal session durations and alert on sessions that persist across administrative state changes.
Monitoring Recommendations
- Forward Open WebUI application logs and terminal server command history to a central SIEM for correlation with identity events.
- Monitor file system changes on the terminal server host and tie them back to the originating WebSocket session identifier.
- Track administrative actions on user accounts and automatically review terminal activity for those accounts in the following hour.
How to Mitigate CVE-2026-109289
Immediate Actions Required
- Upgrade Open WebUI to version 0.11.4 or later, which enforces authorization checks on every terminal WebSocket message.
- Enumerate all active terminal sessions and terminate any that belong to deactivated or recently modified accounts.
- Restrict the terminal feature to a minimal set of trusted administrators until the patched version is deployed.
Patch Information
The maintainers released a fix in Open WebUI 0.11.4. The patch adds per-message authorization enforcement on the terminal proxy route so that revoked users are disconnected from existing WebSocket sessions. Patch details are documented in the GitHub Security Advisory GHSA-6g45-8g27-fh8q.
Workarounds
- Disable the terminal feature in the Open WebUI configuration if it is not required for business operations.
- Place the Open WebUI terminal endpoint behind a reverse proxy that enforces short WebSocket idle timeouts and periodic re-authentication.
- Implement a scheduled job that forcibly closes WebSocket sessions for any account marked as deactivated in the user database.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
