Open WebUI CVE-2026-109572

Requires a valid low-privilege authenticated account on the target Open WebUI instance (PR:L) AND a deployment where the terminal feature/terminal proxy is enabled with one or more configured terminal servers reachable via /api/v1/terminals/{server_id}/{path}. The attack is remote and needs no user interaction, but it is meaningfully limited to multi-user deployments: the proxy must have a valid shared key configured to the backend Terminals admin API, and only versions 0.8.6 through those before 0.11.4 are affected. Single-user or fully trusted-user instances, and instances not using the terminals feature, are not realistically exposed.

This is a genuine but moderate-priority issue rather than an emergency. The CVSS 4.0 score of 7.2 (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation requiring only a low-privilege authenticated account - consistent with the description's 'authenticated users' and CWE-862 (Missing Authorization). The dominant impact is integrity (VI:H): an authenticated user can modify terminal policies and inject environment variables into other users' terminals, with lower confidentiality/availability impact (VC:L/VA:L) from listing and stopping those terminals. No EPSS score, KEV listing, or public POC was provided, so there is no evidence of active exploitation - this is a vendor/researcher-disclosed flaw (VulnCheck) with a patch, not a signal of in-the-wild activity. The source-code diff confirms the root cause and fix (an admin-API path allowlist plus hardened path sanitization against tab/newline-based '..' traversal), which strengthens confidence that the vulnerability is real and well-understood. The key gating factor is that an attacker must already hold a valid account on the Open WebUI instance, which substantially narrows the realistic threat to multi-user deployments with untrusted or semi-trusted users; single-user or trusted-team instances face minimal real-world risk.

An attacker with an ordinary authenticated Open WebUI account sends crafted requests to /api/v1/terminals/{server_id}/{path}, which the terminal proxy forwards to the backend Terminals administrator API with the shared key automatically attached. This lets the attacker enumerate and stop other users' terminal sessions and alter terminal policies - notably injecting attacker-controlled environment variables into victims' terminals. No public exploit was identified at time of analysis, though the patch commit publicly reveals the vulnerable path-handling logic.