CVE-2026-87015: Open WebUI Authentication Bypass Vulnerability

CVE-2026-87015 Overview

CVE-2026-87015 is an information exposure vulnerability [CWE-201] in Open WebUI, an extensible self-hosted AI platform. The flaw exists in backend/open_webui/utils/tools.py where a cookie jar was captured from the enclosing connection loop rather than bound per-callable to each external tool. When multiple tool servers are configured and a session or system OAuth connection is processed last, outbound requests to bearer-authenticated tool servers can leak the calling user's Open WebUI session cookies. An operator of a receiving tool server can then reuse those cookies to hijack the user's account. Versions from 0.6.27 up to but not including 0.11.1 are affected.

Critical Impact
A malicious or compromised tool server operator can capture Open WebUI session cookies from unrelated users and take over their accounts.

Affected Products

Open WebUI 0.6.27 through 0.11.0
Deployments with multiple external tool servers attached
Instances configured with session or system OAuth tool connections

Discovery Timeline

2026-09-09 - CVE-2026-87015 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87015

Vulnerability Analysis

Open WebUI supports attaching external tool servers that the platform calls on behalf of the authenticated user. The vulnerable code in backend/open_webui/utils/tools.py constructs a per-tool async callable but relies on a cookies object captured from the enclosing loop's closure. Because Python closures bind by reference, every generated tool_function ends up sharing the last-iterated cookie jar rather than the one associated with its own tool server.

When a session-authenticated or system OAuth connection is processed last in that loop, its cookie jar, which includes the user's Open WebUI session cookies, becomes the shared value. Subsequent invocations of tools hosted on other servers, even those configured for bearer-token authentication, transmit the leaked session cookies in outbound HTTP requests. The receiving server operator observes the cookies in inbound traffic and can replay them against the Open WebUI instance.

Root Cause

The root cause is a closure-capture defect: the cookie jar was scoped to the outer connection loop instead of being passed as an explicit parameter to each make_tool_function call. This produced cross-tool state contamination rather than per-connection isolation.

Attack Vector

Exploitation requires an attacker to control or operate one of the external tool servers registered with a victim Open WebUI instance. When a user with a session or system OAuth tool connection triggers tool execution, the attacker's server receives the user's session cookies alongside the expected bearer token request. The attacker then reuses those cookies against the Open WebUI web interface to impersonate the user. User interaction is required because the victim must invoke tool execution for cookies to be transmitted.

python

// Patched code in backend/open_webui/utils/tools.py
                         )
                         headers.setdefault('Content-Type', 'application/json')
 
-                        async def make_tool_function(function_name, tool_server_data, headers):
+                        async def make_tool_function(function_name, tool_server_data, headers, cookies):
                             async def tool_function(**kwargs):
                                 return await execute_tool_server(
                                     url=tool_server_data['url'],

Source: GitHub Commit cd9db21. The fix explicitly binds cookies as a parameter to make_tool_function, ensuring each tool callable references only the cookie jar for its own connection.

Detection Methods for CVE-2026-87015

Indicators of Compromise

Outbound HTTP requests from Open WebUI to external tool server URLs containing Cookie: headers with Open WebUI session identifiers.
Inbound authenticated Open WebUI sessions originating from IP addresses associated with registered tool server operators rather than the legitimate user.
Unexpected account activity, such as configuration or model changes, from accounts that recently invoked external tools.

Detection Strategies

Inspect egress traffic from Open WebUI hosts and alert on tool server calls that include session cookies alongside bearer authorization headers.
Correlate tool server IP ranges against source IPs for authenticated web session activity to surface replayed cookies.
Review Open WebUI audit logs for user actions occurring outside typical geolocation or device fingerprints for that account.

Monitoring Recommendations

Enable verbose logging on the tool execution path in Open WebUI and forward logs to a centralized analytics platform.
Monitor Open WebUI version banners across your fleet and flag any host still running a release between 0.6.27 and 0.11.0.
Track newly registered external tool servers and require review before they are enabled for shared-tenant instances.

How to Mitigate CVE-2026-87015

Immediate Actions Required

Upgrade Open WebUI to version 0.11.1 or later, which contains the per-connection cookie binding fix.
Rotate all active Open WebUI session cookies and invalidate existing OAuth session tokens after upgrading.
Audit the list of registered external tool servers and remove any that are not fully trusted.

Patch Information

The issue is fixed in Open WebUI 0.11.1. The maintainers published the fix in commit cd9db21c5276807a2975ddba17cef369ad1114b7 via Pull Request #28630. Release notes are available at Open WebUI v0.11.1 and the coordinated disclosure is tracked in GHSA-p78m-89r6-pgf7.

Workarounds

Detach all external tool servers until the upgrade to 0.11.1 is completed.
Avoid mixing session or system OAuth tool connections with bearer-authenticated tool servers on the same instance.
Restrict tool server registration to operators under direct administrative control while running affected versions.

bash

# Upgrade Open WebUI container to the patched release
docker pull ghcr.io/open-webui/open-webui:0.11.1
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.11.1