CVE-2026-87995: Open WebUI XSS Vulnerability

CVE-2026-87995 Overview

CVE-2026-87995 is a Cross-Site Scripting (XSS) vulnerability in Open WebUI, an extensible self-hosted AI platform. The flaw exists in src/lib/components/chat/FileNav/PortPreview.svelte, which rendered terminal port content inside an iframe sandbox configured with both allow-scripts and allow-same-origin. Because the terminal proxy served that content from the Open WebUI origin, an authenticated attacker with access to a shared terminal server could host script content on a previewed port. When a victim opened the preview, the attacker's script executed in the victim's session context, enabling account takeover. Versions 0.8.11 through 0.11.0 are affected. The issue is fixed in version 0.11.1.

Critical Impact
Authenticated attackers on shared Open WebUI deployments can hijack victim accounts by hosting malicious script on a previewed terminal port.

Affected Products

Open WebUI versions 0.8.11 through 0.11.0
Deployments exposing the terminal proxy and port preview feature
Multi-tenant or shared-terminal-server Open WebUI installations

Discovery Timeline

2026-09-09 - CVE-2026-87995 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87995

Vulnerability Analysis

Open WebUI's port preview component embedded remote terminal-port content in an iframe. The sandbox attribute combined allow-scripts and allow-same-origin, which the HTML sandbox specification explicitly warns against when the embedded content shares the parent origin. Because the terminal proxy served preview content from the Open WebUI origin, the iframe could execute JavaScript with full same-origin privileges relative to the Open WebUI application. This granted attacker-controlled code direct access to cookies, localStorage, session tokens, and authenticated API endpoints.

The vulnerability is categorized as [CWE-79] Improper Neutralization of Input During Web Page Generation. Exploitation requires an authenticated attacker with access to a shared terminal server and a victim who opens the preview.

Root Cause

The root cause is an unsafe iframe sandbox attribute configuration. Specifying both allow-scripts and allow-same-origin for content that is served from the parent origin allows the sandboxed frame to remove its own sandbox restrictions and behave as fully same-origin content. When paired with an attacker-controlled response body from the terminal port proxy, this collapses the isolation boundary the sandbox was intended to provide.

Attack Vector

An authenticated user with the ability to bind services on a shared terminal server hosts a small HTTP responder on any port. The responder returns an HTML document containing JavaScript. When a victim uses the Open WebUI port preview feature to view that port, the browser loads the payload from the Open WebUI origin and executes it in the victim's authenticated context. The script can exfiltrate session material, invoke administrative APIs, or persist changes that take over the victim's account.

text

// Patch excerpt: src/lib/components/chat/FileNav/PortPreview.svelte
 <script lang="ts">
 	import { getContext } from 'svelte';
 	import { getPortProxyUrl } from '$lib/apis/terminal';
+	import { settings } from '$lib/stores';
 	import Tooltip from '$lib/components/common/Tooltip.svelte';

 	const i18n = getContext('i18n');
// Source: https://github.com/open-webui/open-webui/commit/54d7a223707f03172efbb9e754db6e69709956d0

The companion change in SettingsModal.svelte introduces new opt-in flags (terminal preview allow same origin / terminalpreviewallowsameorigin) so that same-origin behavior for the terminal preview must be explicitly enabled by an administrator rather than being the default.

Detection Methods for CVE-2026-87995

Indicators of Compromise

Terminal-server processes bound to unexpected TCP ports that respond with text/html or JavaScript payloads instead of typical terminal application output.
Outbound requests from user browsers to attacker-controlled destinations shortly after opening an Open WebUI port preview.
New administrative actions, API key creations, or profile changes performed from a victim's account without corresponding interactive UI activity.

Detection Strategies

Inventory Open WebUI deployments and confirm the running version against the fixed release v0.11.1.
Review terminal proxy access logs for previews of ports that returned HTML content types.
Correlate port preview events with session token reuse from unexpected IP addresses or user agents.

Monitoring Recommendations

Alert on Open WebUI account privilege changes and API token issuance events.
Monitor egress traffic from user workstations for beacons that follow terminal preview interactions.
Track version drift on Open WebUI hosts to ensure patched builds remain deployed after upgrades or redeployments.

How to Mitigate CVE-2026-87995

Immediate Actions Required

Upgrade all Open WebUI instances to version 0.11.1 or later without delay.
Restrict access to shared terminal servers so untrusted users cannot bind arbitrary listeners.
Rotate session cookies, API keys, and credentials for accounts that may have opened port previews on multi-tenant deployments.

Patch Information

The fix is delivered in Open WebUI v0.11.1. The remediation commit 54d7a22 reworks PortPreview.svelte to remove allow-same-origin from the iframe sandbox by default and gates any relaxation behind an explicit administrator setting. Full details are provided in GitHub Security Advisory GHSA-jmc6-2wr8-h3wj.

Workarounds

Disable the port preview feature until the patched version is deployed.
Limit Open WebUI accounts with terminal access to trusted operators only, and avoid shared terminal servers across trust boundaries.
Do not enable the new terminal preview allow same origin setting introduced in 0.11.1 unless the terminal server is single-tenant and fully trusted.

bash

# Upgrade Open WebUI to the patched release
pip install --upgrade "open-webui>=0.11.1"

# Or for container deployments
docker pull ghcr.io/open-webui/open-webui:v0.11.1
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:v0.11.1