Open WebUI CVE-2026-70486

At least one terminal server must be configured by an administrator via the TERMINAL_SERVER_CONNECTIONS environment variable, which is empty by default - deployments with no terminal server configured are completely unaffected regardless of version. The attacker must hold a valid authenticated account on the Open WebUI instance with access to that configured terminal server; no admin rights are required for the attacker. A multi-step delivery mechanism is required to get the malicious HTML file displayed in the victim's browser: either a prompt-injection attack that injects a display_file tool call into the chat context, or social engineering to have the victim navigate to the preview. Exploitation is further blocked in deployments where TERMINAL_PROXY_HEADERS has been used to inject a restrictive Content-Security-Policy, as those headers are applied to all proxied responses. The srcdoc preview path and all deployments without terminal server configuration are not affected by this vulnerability.

The CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N (8.2) accurately reflects the attack's real-world constraints. AC:H is well-justified: delivering and triggering display of a malicious HTML file requires prompt injection or social engineering against the victim, making this a multi-step attack rather than direct exploitation. PR:L correctly reflects that the attacker needs a valid authenticated account with terminal server access, but no admin privileges. The Scope:Changed metric is critical - the attacker's confined session escapes into the victim's application origin, which is the core of the vulnerability. The highest-severity outcome (server-side RCE via workspace functions) is conditional on the victim being an admin or holding workspace.functions, further limiting blast radius. No EPSS data was provided and this CVE is absent from the CISA KEV catalog, suggesting no observed in-the-wild exploitation at time of analysis. The most important real-world limiting factor is that TERMINAL_SERVER_CONNECTIONS is empty by default, meaning the majority of Open WebUI deployments - particularly quick-start and hobbyist instances - are not exploitable at all. For enterprises or teams that have terminal servers configured, priority should be elevated due to the potential for privilege escalation to RCE.

An attacker with a valid Open WebUI account and access to a configured terminal server writes a malicious HTML file containing JavaScript to the terminal server filesystem, then crafts a prompt injection that triggers an automatic display_file tool call in the victim's active chat session. The iframe opens the HTML file at the application's own origin with allow-scripts and allow-same-origin, causing the script to execute with full access to the parent window - it reads the victim's session token from localStorage and exfiltrates it to an attacker-controlled server. If the victim is an admin, the stolen token is used to install a malicious workspace function that executes arbitrary commands server-side on the Open WebUI host.