Open WebUI CVE-2026-109289

Exploitation requires that the attacker was a legitimately authenticated Open WebUI user who established an active terminal WebSocket connection to the terminal proxy route (terminals.py) BEFORE their account was deactivated; the deactivated session must remain open since the flaw is that authorization is checked only on the first WebSocket message and never re-validated. Limiting factors: the attacker cannot open a NEW session after deactivation, so the window is bounded by keeping the existing socket alive; the terminal feature must be deployed/enabled; and PR:L means prior valid credentials/role granting terminal access were required. Deployments that do not expose or enable the terminal feature are not exploitable.

This is a genuine but moderate-priority issue, best characterized as a privilege-persistence/session-revocation flaw rather than a high-impact RCE. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 (Medium), reflecting network reach but requiring low-level privileges (PR:L) - the attacker must have been a legitimate, authenticated user who already held an active terminal WebSocket before being deactivated. Impacts are rated Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), which understates the practical effect somewhat since the flaw allows arbitrary command execution and file read/write on the terminal server, but is defensible because the actor only retains access they already legitimately had rather than gaining new access. There is no CISA KEV listing and no public exploit was referenced by either the GHSA advisory or VulnCheck, so exploitation status is: no public exploit identified at time of analysis. No EPSS score was supplied in the input, so exploitation-probability cannot be compared against KEV/POC signals - that data is MISSING. The realistic threat is a malicious insider or compromised account whose deactivation is assumed to have cut off access but has not; this is a targeted/insider scenario, not mass internet exploitation. Note the CWE (CWE-613, Insufficient Session Expiration) aligns well with the described root cause (access checked only on the first WebSocket message), reinforcing confidence in the characterization.

An authenticated Open WebUI user opens a terminal session (WebSocket) to the terminal server, then is deactivated by an administrator who believes this revokes all access. Because terminals.py validates authorization only on the first message, the attacker continues sending commands over the still-open socket, executing arbitrary commands and reading or writing files on the terminal server. No public exploit code was identified; exploitation requires the attacker to have established the terminal WebSocket while still active.