CVE-2026-87015

Executive Summary

CVE-2026-87015 is a session-cookie leakage vulnerability in Open WebUI, a self-hosted AI chat platform, affecting versions 0.6.27 through 0.11.0. A defect in backend/open_webui/utils/tools.py caused a cookie jar to be captured from the enclosing connection loop rather than being bound to each individual external tool callable, so that when multiple tool servers were attached and a session or system OAuth connection was processed last, an outbound request to a different server configured for bearer authentication could carry the calling user's Open WebUI session cookies. The operator of that receiving tool server could then reuse the leaked session cookies to hijack the account, resulting in high confidentiality and integrity impact (CVSS 6.8, AV:N/AC:H/PR:N/UI:R, C:H/I:H/A:N).

Technical Analysis

Open WebUI provides an extensible "tools" mechanism in which the platform makes outbound HTTP requests to external tool servers on behalf of authenticated users. The vulnerable component is the Python module backend/open_webui/utils/tools.py. According to the NVD description, this module "captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable."

The essential defect is a scoping/state-management error typical of CWE-201 (Insertion of Sensitive Information Into Sent Data):

1. Shared state across callables. Instead of constructing or retrieving a cookie jar scoped to a single tool invocation (with credentials appropriate to that tool server), the code reused a cookie jar object derived from the enclosing connection loop. This means credentials associated with one connection context could bleed into requests made to a different tool server.

2. Cross-server credential bleed. The exploit condition requires multiple tool servers to be attached to the Open WebUI deployment, and a session or system OAuth connection to be processed as the "last" connection before the vulnerable request. In that state, a request directed at a tool server that is configured for bearer authentication could instead be transmitted with the calling user's Open WebUI session cookies attached.

3. Authentication mechanism confusion. The two servers use different auth schemes — bearer token vs. browser session cookie. Because the cookie jar was not per-callable, the wrong credential type (the session cookie) was sent to the bearer-configured server. That server's operator receives a valid Open WebUI session cookie that is not intended for them.

The fix in 0.11.1 binds the cookie jar to each external tool callable, eliminating the cross-context reuse. Note that AV:N/AC:H/PR:N/UI:R reflects that the attack is network-reachable but requires specific conditions (multiple attached tool servers, particular connection processing order) and some user interaction; exploitation achieves high confidentiality and integrity impact but no direct availability impact.

The public feed provides no PoC, no Nuclei template, and no exploit code, and patch confidence is 0/4 — the details above are derived solely from the NVD description text and the stated vulnerability class.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (sensitive-data insertion into sent data / cookie-jar scope confusion) and the NVD description. Only artifacts named in the description are referenced.

1. Reconnaissance / target identification. The attacker operates (or controls) an external "tool server" that an Open WebUI deployment has attached alongside other tool servers. The attacker's server is not configured for the victim's browser session scheme in a way that would normally entitle it to session cookies; the target of interest is an Open WebUI instance spanning versions 0.6.27–0.11.0 where multiple tool servers are configured.

2. Triggering the flaw class. The victim user (whose Open WebUI session cookie is the target) interacts with the AI platform such that external tool callables are invoked. Per the description, the vulnerable condition is met when a session or system OAuth connection is processed last in the enclosing connection loop before a request is issued to a different tool server configured for bearer authentication. In that ordering, the shared cookie jar captured from the loop carries the user's Open WebUI session cookies into the outbound request.

3. Payload / execution at the vulnerability-class level. The attacker does not need to inject a payload; the vulnerable behavior is the erroneous transmission of the victim's session cookie in an outbound request to the attacker-controlled (or attacker-observable) tool server. The "execution" is the receipt and logging of that inbound HTTP request by the attacker, which contains the session cookie set for the Open WebUI origin.

4. Post-exploitation impact. The operator of the receiving tool server reuses the captured cookie to impersonate the calling user's session — i.e., account takeover of that Open WebUI account. Because the granted impact is C:H/I:H/A:N, the attacker can read all data and perform actions in the victim's account context but is not scored for destroying availability directly. This aligns with T1539 (Steal Web Session Cookie).

Because no exploit code, proof-of-concept, or tooling is publicly reported, defenders should treat the above as a structural description of the vulnerability class rather than a verified step-by-step exploit.

Impact Assessment

• Confidentiality (C:H): Full read access to the victim user's Open WebUI account context, including chats, prompts, attached knowledge, and any data the session cookie authorizes.
• Integrity (I:H): The attacker can modify content, issue requests, and act as the user within the platform.
• Availability (A:N): No direct denial-of-service impact is scored.
• Attack Vector (AV:N): Remotely reachable in deployments where tool servers are reachable over the network.
• Attack Complexity (AC:H): Exploitation depends on non-trivial preconditions: multiple tool servers attached and a specific connection-processing order (session or system OAuth connection processed last) at the moment an outbound bearer-auth request is made.
• Privileges Required (PR:N): The actor controlling the recipient tool server does not need prior Open WebUI privileges.
• User Interaction (UI:R): A user must be active in a session that triggers the vulnerable tool-server request pattern.

Blast radius: Any Open WebUI 0.6.27–0.11.0 deployment that has (a) configured multiple external tool servers and (b) at least one such server not under the operator's full trust. In such deployments, every user who invokes tools while the vulnerable ordering occurs can have sessions leaked to the untrusted tool-server operator, yielding mass account takeover across the user base. Self-hosted single-tool-server installs are far less exposed. Business impact centers on credential/session compromise of an AI platform that often holds sensitive internal prompts, documents, and conversation history.

Detection Guidance

Sigma Rule

title: Potential Open WebUI Session Cookie Leakage to External Tool Servers (CVE-2026-87015)
id: 5c7a1e2b-3d4f-4a90-9b6e-7f1a2c3d4e5f
status: experimental
description: Detects Open WebUI versions 0.6.27-0.11.0 making outbound tool-server requests that unexpectedly carry browser session cookies (potential CVE-2026-87015 exploitation).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87015
author: Valters IT Threat Intelligence
date: 2026-01-01
logsource:
  category: proxy
detection:
  selection_process:
    Image|endswith:
      - '/python'
      - '/python3'
  selection_path:
    cs-uri-stem|contains:
      - '/api/'
      - '/tools/'
  selection_cookie:
    cs(Cookie)|contains:
      - 'token='
  condition: selection_process or (selection_path and selection_cookie)
falsepositives:
  - Legitimate Open WebUI tool requests that are authorized to carry session cookies
  - Normal authenticated API traffic within a single-tool-server deployment
level: medium
tags:
  - attack.t1539
  - cve.2026.87015

YARA Rule

rule CVE_2026_87015_OpenWebUI_CookieJar_Scope
{
    meta:
        description = "Detects Open WebUI tools.py cookie-jar scope handling associated with CVE-2026-87015 (0.6.27-0.11.0)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87015"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $f1 = "utils/tools.py" ascii
        $s1 = "cookie" ascii nocase
        $s2 = "cookiejar" ascii nocase
        $s3 = "bearer" ascii nocase
        $s4 = "httpx" ascii nocase
        $s5 = "requests." ascii
        $ver = "0.6.27" ascii

    condition:
        $f1 and 2 of ($s*) and not $ver
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87015 Open WebUI session cookie transmitted to external tool server"; flow:to_server,established; http.method; content:"POST"; http.header; content:"Cookie"; content:"token="; http.uri; content:"/api/"; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-user; reference:cve,2026-87015; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87015; sid:202687015; rev:1;)

Note: Because exploitation is a credential-leak condition rather than a signature-bearing payload, this network rule is heuristic and should be paired with egress allow-listing of tool-server endpoints to reduce false positives.

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [ network where process.name : ("python", "python3") and
      destination.port in (80, 443) and
      network.direction == "egress" and
      url.path : ("/api/*", "/tools/*") ]
  [ network where process.name : ("python", "python3") and
      network.direction == "egress" and
      destination.ip != null ]

Analyst note: Because session-cookie exfiltration occurs inside the outbound HTTP headers rather than as a distinct event, correlate egress connections to known external tool-server IPs with the presence of a browser-session cookie value. Where HTTP header capture is available, alert when the Cookie header contains an Open WebUI session token and the destination is a tool-server endpoint that is expected to use Authorization: Bearer.

Splunk SPL Query

index=proxy OR index=web
| search (cs_uri_stem="/api/*" OR cs_uri_stem="/tools/*")
| eval has_cookie=if(match(cs_Cookie, "token="), 1, 0)
| eval dst_is_tool=if(match(dest_host, "(?i)tool|server"), 1, 0)
| where has_cookie=1
| stats count values(cs_Cookie) as cookies values(dest_host) as destinations
        by src_ip, dest_host
| where count > 0 AND mvcount(destinations) >= 2
| sort - count
| table src_ip, dest_host, count, cookies

This query highlights hosts sending Open WebUI session cookies to multiple distinct tool-server destinations — a strong signal of the cross-callable cookie-jar bleed described in CVE-2026-87015. Deployments should tune dest_host matching to their actual tool-server inventory.

Wazuh OSSEC Rule

<group name="openwebui,cve-2026-87015,">
  <rule id="100870" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">/api/|/tools/</field>
    <field name="http_cookie">token=</field>
    <description>CVE-2026-87015: Open WebUI session cookie present in outbound tool-server request</description>
    <mitre>
      <id>T1539</id>
    </mitre>
    <group>cve_2026_87015,</group>
  </rule>

  <rule id="100871" level="12">
    <if_sid>100870</if_sid>
    <field name="dest_host">tool</field>
    <description>CVE-2026-87015: Potential session cookie exfiltration to external tool server</description>
    <group>cve_2026_87015,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The following guidance is based on the NVD description, which identifies version 0.11.1 as the fix. No vendor advisory, patch commit, or OSV package data was supplied in the intelligence feed, so the 0.11.1 reference should be independently validated before relying on it.

1. Immediate mitigations (until upgrade is validated):

   • Remove or disable external tool servers that are not under the organization's direct control; the vulnerability requires the presence of multiple attached tool servers and relies on an untrusted recipient.
   • Configure tool servers to avoid the vulnerable ordering — specifically, avoid concurrently attaching both session/OAuth-authenticated connections and bearer-auth tool servers where a session or system OAuth connection may be processed last.
   • Add strict network egress controls so the Open WebUI host can only reach a vetted allow-list of tool-server endpoints, preventing cookie leakage to attacker-controlled destinations.
   • Where possible, segregate high-value user accounts from tool-server invocation, or run tool-enabled instances in a separate low-trust tenant.
   • Monitor outbound requests for Cookie headers targeting bearer-auth endpoints as a compensating detection.

2. Patch/upgrade steps:

   • Upgrade Open WebUI to 0.11.1 (per the NVD description), which binds the cookie jar to each external tool callable.
   • Validate the 0.11.1 artifact against an authoritative source (official Open WebUI release notes / repository tag) before deployment, given the absence of patch-source confirmation in the feed.
   • After upgrade, re-audit attached tool servers and confirm the shared cookie-jar behavior no longer occurs.

3. Long-term hardening:

   • Establish a policy that external tool servers must never receive Open WebUI session cookies; enforce distinct credential domains for browser sessions vs. bearer tokens.
   • Track Open WebUI releases and apply security updates promptly; treat the 0.6.27–0.11.0 range as end-of-life for security purposes.
   • Implement continuous egress monitoring and anomaly detection for credential material (session cookies) leaving the platform boundary.
   • Add automated regression tests that verify per-callable credential binding for all outbound tool requests.

References

1. NVD — CVE-2026-87015: https://nvd.nist.gov/vuln/detail/CVE-2026-87015
2. Open WebUI project repository / release notes (verify 0.11.1 fix): https://github.com/open-webui/open-webui
3. MITRE ATT&CK — T1539 Steal Web Session Cookie: https://attack.mitre.org/techniques/T1539/
4. CWE-201 — Insertion of Sensitive Information Into Sent Data: https://cwe.mitre.org/data/definitions/201.html
5. FIRST EPSS — CVE-2026-87015 (not yet scored at time of writing): https://api.first.org/data/v1/epss?cve=CVE-2026-87015

Threat actor / exploit-in-the-wild status: No CISA KEV listing, no public PoC, no exploit code, and no Nuclei template are associated with CVE-2026-87015 in the supplied intelligence. No threat actor campaign has been reported. Exploitation requires specific deployment preconditions (multiple attached tool servers, particular connection ordering, and an untrusted recipient), which reduces the likelihood of opportunistic mass exploitation but does not eliminate targeted abuse scenarios.