CVE-2026-70490 Overview
Open WebUI is a self-hosted artificial intelligence (AI) platform used to run and manage local large language model (LLM) deployments. CVE-2026-70490 is an authorization flaw [CWE-863] in the terminal WebSocket route defined in backend/open_webui/routers/terminals.py. The route authenticates the first-message JSON Web Token (JWT) but omits the verified-user role gate that get_verified_user enforces on the HTTP terminal endpoints. Accounts in a pending state, including newly registered or deactivated users, can open interactive terminal sessions when a terminal server is configured and grants apply. The vulnerability affects Open WebUI versions from 0.8.8 up to but not including 0.11.0.
Critical Impact
A pending or unapproved account can bypass the approval boundary and obtain an interactive shell through the terminal WebSocket route.
Affected Products
- Open WebUI versions 0.8.8 through 0.10.x
- Deployments with at least one configured terminal server
- Instances where terminal access grants cover pending accounts
Discovery Timeline
- 2026-08-04 - CVE-2026-70490 published to the National Vulnerability Database (NVD)
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-70490
Vulnerability Analysis
Open WebUI enforces a two-stage account lifecycle. Users first register and enter a pending state, then an administrator promotes them to a verified role. HTTP terminal routes call the get_verified_user dependency, which rejects requests from pending accounts. The WebSocket terminal route in backend/open_webui/routers/terminals.py does not invoke this dependency.
Instead, the WebSocket handler validates the JWT presented in the first WebSocket message and treats a valid token as sufficient authorization. The route accepts any authenticated identity, including accounts that were registered but never approved and accounts that administrators deactivated back to pending. When a terminal server is configured and its access rules cover the account, the handler establishes a full interactive session.
The inconsistency between HTTP and WebSocket authorization checks removes the account-approval boundary for terminal access. Attackers with credentials for a low-privilege or unapproved account can obtain command execution capability that the HTTP path would deny.
Root Cause
The root cause is missing role enforcement in the WebSocket authentication path. Authentication and authorization are conflated: token validity is treated as proof of an approved role, while the verified-user check that governs equivalent HTTP routes is absent. This is a classic authorization gap tracked as [CWE-863] (Incorrect Authorization).
Attack Vector
An attacker with credentials for a pending account, obtainable through self-registration on instances that permit it, connects to the terminal WebSocket endpoint and sends a valid JWT in the first message. If a terminal server is configured and grants apply, the server opens a shell. Exploitation requires network access to the WebSocket endpoint and valid low-privilege credentials.
The vulnerability manifests entirely in the server-side authorization logic. See the GitHub Security Advisory for the maintainer's technical write-up.
Detection Methods for CVE-2026-70490
Indicators of Compromise
- WebSocket connections to the terminal route from accounts whose database role is pending
- Terminal session logs referencing user IDs that lack a corresponding approved-account audit record
- Successful terminal WebSocket upgrades that are not preceded by successful HTTP terminal route calls for the same user
Detection Strategies
- Correlate authentication logs with terminal session logs to identify sessions established by non-verified accounts
- Alert on any terminal WebSocket connection where the authenticated principal has a role other than admin or user
- Review Open WebUI application logs for terminal spawn events tied to recently registered accounts
Monitoring Recommendations
- Enable verbose logging on the Open WebUI backend and forward logs to a centralized platform for retention and query
- Monitor for unexpected outbound connections and process activity originating from hosts running configured terminal servers
- Track account state transitions between pending, active, and deactivated and correlate with terminal usage
How to Mitigate CVE-2026-70490
Immediate Actions Required
- Upgrade Open WebUI to version 0.11.0 or later, which restores the verified-user check on the terminal WebSocket route
- Audit all accounts currently in the pending state and remove any that are unexpected
- Review terminal server access grants and restrict them to explicitly approved user roles
Patch Information
The issue is fixed in Open WebUI 0.11.0. The patch adds the get_verified_user role gate to the WebSocket handler in backend/open_webui/routers/terminals.py, aligning WebSocket authorization with the HTTP terminal routes. Refer to the GitHub Security Advisory GHSA-5gpj-vj23-vhhv for release details.
Workarounds
- Disable terminal server integration until the upgrade is applied
- Disable self-service registration to prevent creation of unapproved accounts
- Restrict network access to the Open WebUI WebSocket endpoint to trusted administrative networks
# Configuration example: disable open registration and terminal integration
export ENABLE_SIGNUP=false
export ENABLE_TERMINAL=false
# Then restart the Open WebUI service
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
