https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 12:29:57 +0000 https://vulnerability.circl.lu/vuln/cve-2026-59224 <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/open_webui/routers/terminals.py built the ws_terminal upstream URL from an unencoded session_id and appended user_id as a query parameter, allowing query injection to make the terminal backend resolve another user identity; the HTTP proxy path also forwarded X-User-Id as an integrity-unbound identity claim. This issue is fixed in version 0.10.0.</p> <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/open_webui/routers/terminals.py built the ws_terminal upstream URL from an unencoded session_id and appended user_id as a query parameter, allowing query injection to make the terminal backend resolve another user identity; the HTTP proxy path also forwarded X-User-Id as an integrity-unbound identity claim. This issue is fixed in version 0.10.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-59224 https://vulnerability.circl.lu/vuln/ghsa-j657-m4c4-24jq <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>The terminal proxy in `backend/open_webui/routers/terminals.py` forwards the Open WebUI user&#39;s identity to the upstream terminal server / backend coordinator as an authorization claim, with no cryptographic binding to the session that produced it. The forwarded identity is attacker-influenceable on both proxy paths:</p> <p>1. **HTTP path (`proxy_terminal`)** sets `headers[&#39;X-User-Id&#39;] = user.id`. Upstreams that trust `X-User-Id` as identity receive it unsigned, so an attacker who can reach the upstream by other means (directly, a compromised peer, SSRF) can spoof it. 2. **WebSocket path (`ws_terminal`)** is exploitable through Open WebUI itself, with no &#34;other means&#34; required. It interpolates the path parameter `session_id` directly into the upstream URL and then appends `?user_id=&lt;caller&gt;`:</p> <p>```python upstream_url = f&#39;{ws_base}/p/{policy_id}/api/terminals/{session_id}&#39; upstream_url += f&#39;?{urllib.parse.urlencode({&#34;user_id&#34;: user.id})}&#39; ```</p> <p>`session_id` is neither validated nor URL-encoded (the HTTP sibling runs `_sanitize_proxy_path`; this path runs nothing). An encoded `?`/`&amp;` smuggled through `session_id` survives Open WebUI&#39;s single decode and is re-decoded by the upstream, injecting an attacker-chosen `user_id` ahead of the appended one. Query parsing binds the first occurrence, so the backend coordinator resolves the spoofed user&#39;s terminal scope.</p> <p>## Technical Details</p> <p>The forwarded terminal identity is a bearer-style authorization claim with no inte…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>The terminal proxy in `backend/open_webui/routers/terminals.py` forwards the Open WebUI user&#39;s identity to the upstream terminal server / backend coordinator as an authorization claim, with no cryptographic binding to the session that produced it. The forwarded identity is attacker-influenceable on both proxy paths:</p> <p>1. **HTTP path (`proxy_terminal`)** sets `headers[&#39;X-User-Id&#39;] = user.id`. Upstreams that trust `X-User-Id` as identity receive it unsigned, so an attacker who can reach the upstream by other means (directly, a compromised peer, SSRF) can spoof it. 2. **WebSocket path (`ws_terminal`)** is exploitable through Open WebUI itself, with no &#34;other means&#34; required. It interpolates the path parameter `session_id` directly into the upstream URL and then appends `?user_id=&lt;caller&gt;`:</p> <p>```python upstream_url = f&#39;{ws_base}/p/{policy_id}/api/terminals/{session_id}&#39; upstream_url += f&#39;?{urllib.parse.urlencode({&#34;user_id&#34;: user.id})}&#39; ```</p> <p>`session_id` is neither validated nor URL-encoded (the HTTP sibling runs `_sanitize_proxy_path`; this path runs nothing). An encoded `?`/`&amp;` smuggled through `session_id` survives Open WebUI&#39;s single decode and is re-decoded by the upstream, injecting an attacker-chosen `user_id` ahead of the appended one. Query parsing binds the first occurrence, so the backend coordinator resolves the spoofed user&#39;s terminal scope.</p> <p>## Technical Details</p> <p>The forwarded terminal identity is a bearer-style authorization claim with no inte…</p> https://vulnerability.circl.lu/vuln/ghsa-j657-m4c4-24jq