CVE-2026-59224: Open WebUI Terminal Proxy User Identity Spoofing
Open WebUI
The Open WebUI terminal proxy forwarded unverified user identity claims to upstream components. Attackers could potentially exploit this to spoof user headers.
disclosed CVENo confirmed exploitation, so this record is tracked as a disclosed vulnerability and not counted as an incident. It moves into the counts if CISA or the vendor confirms exploitation. Why
- CVSS
- 8.0
- EPSS
- <0.01 · top 67% · 2026-11-13
- fix status
- Fix status unknown
- first report
- 9 Jul 2026
- last update
- 24 Jul 2026
- CVE ids
Timeline · 2
Sources · 2
Advisories and databases
- 2026-07-09CVE-2026-59224: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.NVD · nvd.nist.gov/vuln/detail/CVE-2026-59224
- 2026-07-24CVE-2026-59224: Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal…GitHub Advisory Database · github.com/advisories/GHSA-j657-m4c4-24jq
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Patch now
- AI role
- Attack on AI
- categories
- Infrastructure vulnerability
- severity
- 2 · Disclosed vulnerability
- fix status
- Fix status unknown
- targets
- Framework / tooling
- owasp llm top 10
- LLM03:2025 Supply Chain
- mitre atlas
- no technique for these categories
- dates
- happened 24 Jul 2026 · first reported 9 Jul 2026
- origin
- GitHub Advisory DatabaseVulnerability record from NVD / the GitHub Advisory Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- record
- confidence 0.95 · created 2026-10-18 07:00Z · updated 2026-10-18 10:04Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# CVE-2026-59224: Open WebUI Terminal Proxy User Identity Spoofing https://gcdradar.vercel.app/incidents/cve-2026-59224-open-webui-terminal-proxy-user-identity-spoof · AIR-2026-0851 · closed 2026-07-09 - Lane: Patch now - Severity: 2 (Disclosed vulnerability) - Fix status: Fix status unknown - First reported: 2026-07-09 (happened 2026-07-24) - AI role: Attack on AI - Products: Open WebUI - CVE ids: CVE-2026-59224 - CVSS: 8 ## Summary The Open WebUI terminal proxy forwarded unverified user identity claims to upstream components. Attackers could potentially exploit this to spoof user headers. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2026-07-24: CVE-2026-59224: Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal… (https://github.com/advisories/GHSA-j657-m4c4-24jq) - 2026-07-09: CVE-2026-59224: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. (https://nvd.nist.gov/vuln/detail/CVE-2026-59224) ## Sources - 2026-07-09 NVD: CVE-2026-59224: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. https://nvd.nist.gov/vuln/detail/CVE-2026-59224 - 2026-07-24 GitHub Advisory Database: CVE-2026-59224: Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal… https://github.com/advisories/GHSA-j657-m4c4-24jq Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closed7.7Open WebUI Open WebUI SSRF Vulnerability CVE-2026-70479 via Playwright
Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-70479
AI - closed3.1Open WebUI Open WebUI Vulnerability CVE-2026-70483 Enables Chat Task Abortions
Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-70483
AI - closed4.1Open WebUI Open WebUI Vulnerability CVE-2026-70480 Allows Outbound Requests
Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-70480
AI - closed8.7Open WebUI CVE-2026-70492: Open WebUI stored XSS vulnerability in math block rendering
Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-70492
AI - closed5.3Open WebUI CVE-2026-70487: Open WebUI unauthorized knowledge file access vulnerability
Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-70487
AI - closed5.4Open WebUI CVE-2026-70481: Open WebUI authorization flaw in standard channel messages
Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-70481
AI