2026-07-09 · 2026-Q3
Open WebUI 16-Flaw Security Batch (CVE-2026-59212 to CVE-2026-59227)
Which agent, run, or tenant is this?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
Open WebUI (self-hosted LLM interface) before 0.10.0
Impact
Sixteen flaws fixed at once. The most severe include identity spoofing on the terminal WebSocket via an unencoded `session_id` (CVE-2026-59224, CVSS 8.0), running code in another user's session through client-supplied session IDs on `execute:python`/`execute:tool` events (CVE-2026-59216), a nine-times percent-encoded path-traversal bypass of an eight-pass decode (CVE-2026-59221), a Pyodide same-origin worker reaching admin endpoints (CVE-2026-59214), and revoked JWTs still authenticating realtime connections (CVE-2026-59219)
Root cause
Missing authorization on realtime socket events, client-trusted session identifiers, and incomplete input decoding across a self-hosted LLM UI
CVEs
Sources
Catalog
Cite this: AgentProv incident record: Open WebUI 16-Flaw Security Batch (CVE-2026-59212 to CVE-2026-59227) (2026-07-09). https://agentprov.com/incidents/2026-07-09-open-webui-16-flaw-security-batch-cve-2026-59212-to-cve-2026-59227
Related
- Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
- Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
- Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run