CVE-2026-87016: Open WebUI SQL Injection Vulnerability

CVE-2026-87016 Overview

Open WebUI is a self-hosted AI platform that supports OAuth and SCIM identity providers for user management. CVE-2026-87016 is an authentication bypass vulnerability affecting versions 0.6.41 through 0.11.0. The flaw resides in get_user_by_oauth_sub and get_user_by_scim_external_id functions in backend/open_webui/models/users.py, which used JSON contains matching that compiled to SQL LIKE substring matching on SQLite backends. An attacker whose OAuth subject identifier contains % or _ wildcard characters can match a different stored identity, potentially resolving to an administrator account and receiving that account's session. PostgreSQL deployments are not affected. This issue is classified under [CWE-155: Improper Neutralization of Wildcards or Matching Symbols].

Critical Impact
An attacker controlling an OAuth subject value with wildcard characters can hijack an administrator session on Open WebUI SQLite deployments, gaining full control over the AI platform.

Affected Products

Open WebUI versions 0.6.41 through 0.11.0 (SQLite backend)
backend/open_webui/models/users.py identity lookup functions
Deployments using OAuth or SCIM identity federation with SQLite storage

Discovery Timeline

2026-09-09 - CVE-2026-87016 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87016

Vulnerability Analysis

Open WebUI resolves federated identities by looking up the OAuth sub claim or SCIM external ID in a JSON column on the users table. On SQLite, SQLAlchemy's JSON.contains operator compiles to a SQL LIKE expression against the serialized JSON text. LIKE treats % as a multi-character wildcard and _ as a single-character wildcard, so an attacker-supplied subject containing these characters becomes a pattern rather than a literal value.

When the crafted pattern matches multiple stored identities, the database returns the first row, which may belong to a privileged user. The application then issues a session bound to that returned account. The result is horizontal or vertical privilege escalation, including takeover of administrator accounts that control model configuration, user provisioning, and integrated tool access.

Root Cause

The underlying defect is improper neutralization of wildcard characters in a matching operation [CWE-155]. Identity lookups relied on substring semantics instead of exact JSON key equality. PostgreSQL escapes this because SQLAlchemy compiles JSON operations to JSONB operators that perform structural equality, which is why only SQLite deployments are exploitable.

Attack Vector

Exploitation requires an attacker to control the OAuth subject returned to Open WebUI. This is feasible when the platform trusts a self-service identity provider, allows dynamic client registration, or federates with an IdP where the sub field is user-influenced. The attacker registers or provisions an identity whose subject contains wildcards designed to match an existing administrator's stored subject as a substring.

python

     select,
     update,
 )
-from sqlalchemy.dialects.postgresql import JSONB
 from sqlalchemy.ext.asyncio import AsyncSession
 
 ####################

Source: GitHub Commit 73c1f58. The patch refactors provider identity lookups to use JSON subscript access, eliminating the LIKE-based substring match that caused the confusion.

Detection Methods for CVE-2026-87016

Indicators of Compromise

OAuth or SCIM provisioning events where the subject identifier contains % or _ characters not typical of the identity provider's normal ID format.
Successful logins where the authenticated Open WebUI account differs from the identity provider account that initiated the OAuth flow.
Unexpected administrator sessions originating from IP addresses or user agents associated with non-privileged users.

Detection Strategies

Audit the oauth_sub and scim_external_id fields in the Open WebUI users table for values containing % or _ wildcard characters.
Correlate identity provider logs with Open WebUI session logs to detect subject-to-account mismatches.
Alert on privilege changes, API key generation, or model configuration edits performed shortly after a new OAuth login.

Monitoring Recommendations

Forward Open WebUI application logs and reverse proxy access logs to a centralized analytics platform for retrospective hunting.
Monitor for administrative endpoint activity (/api/v1/auths/, /api/v1/users/) initiated by newly federated identities.
Track OAuth sub values at provisioning time and reject any containing SQL wildcard characters at the proxy layer.

How to Mitigate CVE-2026-87016

Immediate Actions Required

Upgrade Open WebUI to version 0.11.1 or later, which replaces substring matching with JSON subscript equality.
Rotate session secrets and invalidate active sessions to evict any attacker sessions established before patching.
Review administrator account membership and recent privilege grants for unauthorized additions.

Patch Information

The fix is included in Open WebUI v0.11.1 via pull request #28624. Details are documented in the GitHub Security Advisory GHSA-wpmr-8h3q-fwj7. Administrators unable to upgrade immediately should migrate the backing store from SQLite to PostgreSQL, which is not affected.

Workarounds

Migrate the Open WebUI database from SQLite to PostgreSQL, which uses JSONB operators that perform exact matching.
Enforce validation at the OAuth proxy or middleware layer to reject subject identifiers containing % or _.
Restrict OAuth federation to identity providers that issue opaque, wildcard-free subject identifiers.

bash

# Upgrade Open WebUI to the patched release
pip install --upgrade open-webui==0.11.1

# Or for Docker deployments
docker pull ghcr.io/open-webui/open-webui:v0.11.1
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:v0.11.1