Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- Critical, CVSS 9.0
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
- Record
- CVE-2026-59216
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 9, 2026
- Source last modified
- July 24, 2026
Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call delivered execute:python and execute:tool Socket.IO events to a client-supplied session_id after checking only that the session was connected, allowing authenticated users who learned another socket ID through ydoc:document:join to run code interpreter Python or tools in that user session. This issue is fixed in version 0.10.0.
Description quoted from the NVD record.
Who is affected
Open WebUI is a chat interface for AI models that organizations run on their own computers or servers. This flaw affects versions before 0.10.0. A person with an account who is signed in could learn the connection ID of another user's session through the feature for joining shared documents. That person could then make the other user's session run Python code in the code interpreter or run tools. In other words, one user could act through another user's session. This flaw is rated Critical.
What to do
- If you or someone on your staff installed and runs Open WebUI, that person should update it to version
0.10.0or later, which fixes this flaw. - If an IT provider or vendor runs Open WebUI for your organization, send them this advisory and ask when the update to version
0.10.0will be done. - If you are not sure whether your organization uses Open WebUI, ask the person or company that looks after your computers and AI tools.
- After the update, have the person who made it check that the installed version of Open WebUI is
0.10.0or later.
Analysis written from the source record as of July 24, 2026 and reviewed before publishing.