What is the CVSS score of CVE-2026-59216?

CVE-2026-59216 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Open WebUI are affected by CVE-2026-59216?

A critical remote code execution flaw in Open WebUI prior to version 0.10.0 permits authenticated users to execute arbitrary Python code and invoke tools within other logged-in users' sessions…. A patch is available.

Is there a public PoC exploit available for CVE-2026-59216?

Yes, a public proof-of-concept exploit is available for CVE-2026-59216. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-59216?

Within 24 hours, identify all systems running Open WebUI prior to version 0.10.0 and assess whether they face exposure to untrusted networks; implement network segmentation if immediate upgrade is not feasible. Within 7 days, upgrade all affected Open WebUI installations to version 0.10.0 or later. Within 30 days, audit access logs from the past 90 days for suspicious execution patterns and unauthorized code invocations, then review user access permissions to eliminate unnecessary privileges.

Open WebUI CVE-2026-59216

EUVD-2026-42627 CRITICAL

Code Injection (CWE-94)

2026-07-09 security-advisories@github.com

GHSA-74h3-cxq7-vc5q

Code Injection Python RCE Open Webui

9.0

CVSS 3.1 · NVD

Severity by source

Vendor (github) PRIMARY

HIGH

qualitative

NVD

9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Authenticated user (PR:L) abuses Socket.IO over the network with low complexity; code executes in another user's live session (S:C, UI:R), giving full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 13, 2026 - 12:44 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jul 13, 2026 - 12:43 vuln.today

Analysis Updated

Jul 13, 2026 - 12:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 13, 2026 - 12:37 vuln.today

cvss_changed

Severity Changed

Jul 13, 2026 - 12:37 NVD

HIGH CRITICAL

CVSS changed

Jul 13, 2026 - 12:37 NVD

7.7 (HIGH) 9.0 (CRITICAL)

Patch available

Jul 09, 2026 - 18:01 EUVD

Analysis Generated

Jul 09, 2026 - 17:32 vuln.today

DescriptionNVD

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call delivered execute:python and execute:tool Socket.IO events to a client-supplied session_id after checking only that the session was connected, allowing authenticated users who learned another socket ID through ydoc:document:join to run code interpreter Python or tools in that user session. This issue is fixed in version 0.10.0.

Articles & Coverage 1

News 4 New Python Vulnerabilities - 4 High Severity, 2 With POC Jul 10, 2026

AnalysisAI

Cross-user remote code execution in Open WebUI before 0.10.0 lets an authenticated user run arbitrary code interpreter Python or invoke tools inside another logged-in user's session. The get_event_call handler dispatched execute:python and execute:tool Socket.IO events to any client-supplied session_id that was merely 'connected', so an attacker who harvested a victim's socket ID via the ydoc:document:join collaboration flow could hijack that session. A proof-of-concept is indicated in the SSVC data, though the flaw is not in CISA KEV and EPSS rates near-term mass exploitation low (0.28%, 19th percentile).

Technical ContextAI

Open WebUI is a self-hosted AI/LLM front-end that uses a Socket.IO real-time channel to drive interactive features, including a Python code interpreter and tool-calling. The vulnerable get_event_call function (backend/open_webui/socket/main.py) trusted a client-supplied session_id and, prior to the fix, only verified that the target session existed in SESSION_POOL - it never checked that the session belonged to the requesting user. This is a CWE-94 (improper control of code generation / code injection) issue compounded by a missing authorization/ownership check: because execute:python and execute:tool events were delivered to whatever session was named, an attacker could steer code execution into a foreign session. Socket/session IDs are learnable through the ydoc:document:join collaborative-document mechanism, which is what makes the client-supplied identifier attacker-controllable. The CPE cpe:2.3:a:openwebui:open_webui confirms the affected product across all versions below 0.10.0.

RemediationAI

Vendor-released patch: upgrade to Open WebUI 0.10.0 or later (https://github.com/open-webui/open-webui/releases/tag/v0.10.0), which adds an ownership check so get_event_call only delivers execute:python/execute:tool events to a session whose stored user id matches the requesting user (fix commit 386ac958144dbbbf0aa6e268070d72b681a318aa via PR #25763). Until you can upgrade, reduce exposure by tightly restricting who holds accounts on the instance (the attacker must be authenticated), and where feasible disable or lock down the code interpreter/Python execution and tool features and the collaborative document (ydoc) functionality that leaks session IDs - the trade-off is loss of code-interpreter and real-time collaboration capabilities for legitimate users. Also limit network reach to the Socket.IO endpoint to trusted users/networks. Consult advisory GHSA-74h3-cxq7-vc5q for authoritative guidance.