CVE-2026-109572: Open WebUI terminal proxy lets regular users act as Terminals admin

What it is

GitHub advisory: “Open WebUI forwarded any requested path and attached the administrator-configured shared key, so Terminals treated the request as an administrator request.”

NVD adds that this let attackers inject environment variables into other users’ terminals through /api/v1/terminals/{server_id}/{path}.

Preconditions: an admin added a Terminals connection using bearer auth, the attacker was granted access to it, the connection is not pinned to a named policy, and the Terminals server is older than 0.2.4. Deployments without a Terminals connection are not affected.

How to check

1. Affected: open-webui 0.8.6 up to (not including) 0.11.4.
2. Check Admin settings for any Terminals connection and who has access to it.

How to fix

1. Upgrade Open WebUI to 0.11.4 or later. The same release also fixes more than a dozen other XSS, authorization and denial-of-service issues.
2. Upgrade the Terminals server to 0.2.4 or later, which blocks this path on its own.

pip show open-webui | grep Version
# Docker: docker pull ghcr.io/open-webui/open-webui:main

Sources

• GitHub Security Advisory GHSA-q46m-r89w-j74p ↗
• NVD: CVE-2026-109572 ↗
• VulnCheck advisory ↗