https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 15:29:23 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-87015 <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached and a session or system OAuth connection was processed last, a request to a different server configured for bearer authentication could include the calling user&#39;s Open WebUI session cookies, allowing that server&#39;s operator to reuse the session and take over the account. This issue is fixed in version 0.11.1.</p> <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached and a session or system OAuth connection was processed last, a request to a different server configured for bearer authentication could include the calling user&#39;s Open WebUI session cookies, allowing that server&#39;s operator to reuse the session and take over the account. This issue is fixed in version 0.11.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-87015 https://db.gcve.eu/vuln/ghsa-p78m-89r6-pgf7 <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>When more than one external tool server is reachable in the same request, a tool call to a server configured for bearer authentication can arrive carrying the calling user&#39;s Open WebUI session cookies alongside that server&#39;s own key. The cookie jar is built per connection, but the callable that performs the request reads it late instead of per connection, so every tool callable built in the same pass sends the cookies belonging to whichever connection was processed last. An administrator who configures a server with its own API key has not chosen to send that server anything else, and the operator of that server receives a live session credential for the user who triggered the call.</p> <p>## Preconditions</p> <p>At least two external tool servers must be attached to the same request, and at least one of them must be set to session or system OAuth authentication, since no cookie jar is assembled otherwise. The connection using that authentication mode must be the one processed last, which follows the order of the tool servers attached to the request rather than anything the receiving party controls.</p> <p>A deployment with no tool servers, with only one tool server, or where no attached server uses session or system OAuth authentication, is not affected. Tool servers are not configured by default.</p> <p>## Impact</p> <p>The operator of a tool server that was configured with only its own API key receives the session token of every user whose tool call reaches it. That token authenticates as…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>When more than one external tool server is reachable in the same request, a tool call to a server configured for bearer authentication can arrive carrying the calling user&#39;s Open WebUI session cookies alongside that server&#39;s own key. The cookie jar is built per connection, but the callable that performs the request reads it late instead of per connection, so every tool callable built in the same pass sends the cookies belonging to whichever connection was processed last. An administrator who configures a server with its own API key has not chosen to send that server anything else, and the operator of that server receives a live session credential for the user who triggered the call.</p> <p>## Preconditions</p> <p>At least two external tool servers must be attached to the same request, and at least one of them must be set to session or system OAuth authentication, since no cookie jar is assembled otherwise. The connection using that authentication mode must be the one processed last, which follows the order of the tool servers attached to the request rather than anything the receiving party controls.</p> <p>A deployment with no tool servers, with only one tool server, or where no attached server uses session or system OAuth authentication, is not affected. Tool servers are not configured by default.</p> <p>## Impact</p> <p>The operator of a tool server that was configured with only its own API key receives the session token of every user whose tool call reaches it. That token authenticates as…</p> https://db.gcve.eu/vuln/ghsa-p78m-89r6-pgf7