CVE-2026-59224

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.10.0

Description In the backend/open webui/routers/terminals.py file, the ws terminal upstream URL is constructed using an unencoded session id and appends user id as a query parameter. This allows for query injection, enabling the terminal backend to resolve a different user identity. Additionally, the HTTP proxy path forwards X-User-Id as an integrity-unbound identity claim, which is a claim that lacks a mechanism to verify it has not been tampered with.

Recommendations Update to version 0.10.0.