CVE-2026-87995

Executive Summary

CVE-2026-87995 is a stored cross-site scripting (XSS) vulnerability in Open WebUI, a self-hosted AI platform, affecting versions 0.8.11 through 0.11.0. The flaw resides in the PortPreview.svelte frontend component, which rendered terminal port content inside an iframe sandbox configured with both allow-scripts and allow-same-origin. Because the terminal proxy serves previewed content from the Open WebUI origin itself, an authenticated attacker with access to a shared terminal server could host malicious script on a previewed port, then capture a victim's session when the victim opens the preview. Because the iframe content is same-origin, the allow-scripts and allow-same-origin combination permits the embedded document to access parent-origin resources, defeating sandbox isolation and enabling full account takeover of the victim. The issue is fixed in version 0.11.1.

Technical Analysis

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — 'Cross-site Scripting'). The relevant component is src/lib/components/chat/FileNav/PortPreview.svelte, a Svelte frontend file that renders the output of a terminal port preview inside an <iframe>.

The core mechanism is a sandbox-escape condition caused by an insecure iframe sandbox attribute combination. The sandbox contained both:

• allow-scripts — permitting the framed document to execute JavaScript.
• allow-same-origin — permitting the framed document to retain its origin (the Open WebUI origin) rather than being treated as a unique opaque origin.

When both tokens are present and the framed content is served from the same origin as the embedding application, the effective sandbox protections are nullified. This is a well-known and documented anti-pattern: the HTML specification and MDN explicitly warn that combining allow-scripts and allow-same-origin on same-origin content allows the embedded page to remove its own sandbox attribute and act with full privileges of the hosting origin. Here, the terminal proxy serves the previewed port content from the Open WebUI origin — meaning any script hosted on a previewed port executes in the Open WebUI origin context.

Attack surface: any authenticated Open WebUI user who has access to a shared terminal server can bind a service to a port and cause victim users to preview that port. Because the previewed content is same-origin, script inside it can read the Open WebUI DOM, cookies accessible to JavaScript, and session tokens stored in accessible locations within the document context, and can issue authenticated same-origin requests on behalf of the victim.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N reflects:

• Network attack vector, low attack complexity.
• Low privileges required (an authenticated user with terminal-server access).
• User interaction required (the victim must open the preview).
• Changed scope (S:C) — the vulnerable component (terminal preview sandbox) permits impact to resources beyond its intended security scope (the host Open WebUI origin).
• High confidentiality and integrity impact; no availability impact.

No public proof-of-concept, Nuclei template, or exploit code is currently available. The attack chain below is therefore described at the vulnerability-class level and inferred from the NVD description.

Exploitation Scenarios

Because the NVD description is the sole authoritative source, the following chain is described at the vulnerability-class level. No function names, endpoints, or parameters beyond those in the description are asserted.

1. Reconnaissance / target identification: The attacker identifies an Open WebUI deployment in the affected version range (0.8.11 ≤ version < 0.11.1) — for example via the Shodan dorks above — and obtains an authenticated account that has access to a shared terminal server. Reconnaissance also involves identifying victim users who share access to the same terminal server and who may open port previews.

2. Triggering the flaw class (stored XSS via sandbox escape): The attacker hosts or runs a service on a port available through the terminal server. That service responds with attacker-controlled HTML/JavaScript. The attacker induces or waits for a victim to open the port preview in the PortPreview.svelte component. Because the terminal proxy serves the content from the Open WebUI origin, and because the iframe sandbox grants both allow-scripts and allow-same-origin, the malicious script executes with same-origin privileges rather than being confined to an opaque origin.

3. Payload / execution (vulnerability-class level): The attacker's script runs in the Open WebUI origin. In same-origin XSS conditions, the script can read and manipulate the embedding page's DOM, access data reachable from the document context, and issue authenticated requests to the Open WebUI application as the victim. The exact payload is not specified in the provided data; only the class (script executing in the host origin) is asserted.

4. Post-exploitation impact: Per the CVSS impact metrics, confidentiality and integrity are High and scope is changed. This corresponds to full account takeover of the victim — an authenticated attacker can act as the victim within Open WebUI, exfiltrate data available to the victim's session, and modify content. No availability impact is scored.

No public PoC available; attack chain is inferred from the vulnerability class.

Impact Assessment

• Confidentiality: High — script executing in the Open WebUI origin can access data available to the victim's authenticated session in the document context, consistent with the scored C:H.
• Integrity: High — the attacker can manipulate the victim's session and application state, consistent with C:I:H.
• Availability: None — no availability impact is scored (A:N).
• Scope: Changed — the sandbox is intended to constrain the previewed content, but the flaw lets it affect the enclosing Open WebUI origin (S:C).

Blast radius: Any Open WebUI deployment in versions 0.8.11–0.11.0 where users share access to a terminal server and preview ports. In multi-user self-hosted deployments (teams, shared instances), a single authenticated user with terminal access can target multiple victims. Because the attack requires user interaction (opening the preview), exploitation is not fully autonomous but can be socially engineered or staged for opportunistic clicks. Open WebUI is frequently deployed on internal networks and as an internal AI chat platform, so account takeover may grant access to chat history, configured model/API credentials exposed to the UI, and downstream integrations reachable with the victim's privileges.

Detection Guidance

Sigma Rule

This rule targets anomalous access to the Open WebUI port-preview path. It is a best-effort detection based on the component name from the NVD description; deployments should adjust the URL path to match their environment.

title: Open WebUI Port Preview Same-Origin Script Access (CVE-2026-87995)
id: 7c1e9f2a-8b4d-4a6e-9c3f-0d2b6f1a5e77
status: experimental
description: Detects access to the Open WebUI terminal port preview endpoint implicated in CVE-2026-87995, where same-origin iframe content can execute script in the Open WebUI origin.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87995
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: open_webui
detection:
  selection_preview:
    cs-uri-stem|contains:
      - '/port/'
      - '/preview'
      - '/terminal'
  selection_encoding:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
  condition: selection_preview
falsepositives:
  - Legitimate port preview usage
level: medium
tags:
  - attack.t1189
  - cve.2026.87995

YARA Rule

rule CVE_2026_87995_OpenWebUI_PortPreview_XSS
{
    meta:
        description = "Detects Svelte PortPreview components referencing insecure iframe sandbox combinations tied to CVE-2026-87995 in Open WebUI source/deployments"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87995"
        date = "2026-01-01"
        severity = "high"

    strings:
        $svelte = "PortPreview.svelte"
        $sandbox = "sandbox"
        $allowsandbox_scripts = "allow-scripts"
        $allowsandbox_origin = "allow-same-origin"

    condition:
        $svelte and $sandbox and $allowsandbox_scripts and $allowsandbox_origin
}

Suricata IDS Rule

Detects HTTP responses from the terminal proxy that carry inline script while a port-preview is requested. Path tokens are derived strictly from the component description ("port preview"); tune the uri to your deployment.

alert http any any -> any any (msg:"CVE-2026-87995 Open WebUI Port Preview Same-Origin Script"; flow:established,to_client; http.uri; content:"/port"; http.response_body; content:"<script"; nocase; http.response_body; content:"allow-same-origin"; nocase; classtype:web-application-attack; reference:cve,2026-87995; sid:202687995; rev:1;)

Elastic Detection

sequence by user.name with maxspan=1m
  [ network where url.path : ("*port*" or "*preview*") and http.request.method == "GET" ]
  [ network where http.response.body.text : "*allow-same-origin*" and http.response.body.text : "*<script*" ]

Splunk SPL Query

index=web OR index=proxy
| search (uri_path="*port*" OR uri_path="*preview*")
| eval suspicious=if(match(response_body, "(?i)<script") AND match(response_body, "allow-same-origin"), 1, 0)
| where suspicious=1
| stats count values(uri_path) as preview_paths by src_ip user_agent
| sort - count

Wazuh OSSEC Rule

<group name="open_webui,web,cve-2026-87995,">
  <rule id="2026879" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>\/port|\/preview|\/terminal</url>
    <description>CVE-2026-87995 - Open WebUI terminal port preview access (possible same-origin XSS abuse)</description>
    <mitre>
      <id>T1189</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED as recorded by tracked sources).

1. Immediate mitigations (apply before upgrade where the patch cannot be deployed):

   • Restrict access to shared terminal servers in Open WebUI so that untrusted or low-privilege users cannot host services on previewable ports.
   • Treat any user with terminal-server access as potentially untrusted; segregate terminal-enabled users from administrative or sensitive accounts.
   • Remove or disable the terminal port-preview capability until version 0.11.1 is deployed, if operationally feasible.
   • Enforce strong Content Security Policy (CSP) headers at the reverse proxy in front of Open WebUI to limit same-origin script execution; note that CSP is a defense-in-depth control and does not replace the vendor fix.
   • Monitor for and block egress script injection into previewed content where control over the preview pipeline exists.

2. Patch / upgrade steps:

   • Upgrade Open WebUI to version 0.11.1 or later, which the NVD description states fixes this issue.
   • Verify the running version after upgrade and confirm the PortPreview.svelte component no longer combines allow-scripts and allow-same-origin on same-origin proxied content.
   • Because the vendor/product metadata is recorded as Unknown and no OSV package or patch source is tracked, validate patch provenance directly against the upstream Open WebUI project release notes for 0.11.1.

3. Long-term hardening:

   • Never combine allow-scripts and allow-same-origin in an iframe sandbox serving same-origin content; serve previewed content from an isolated origin or subdomain instead.
   • Adopt an application-level origin-isolation architecture (separate hostname for user-generated/preview content) so that even if XSS occurs, it cannot reach the primary application origin.
   • Enable CSP with script-src restrictions and frame-ancestors/frame-src policies aligned to the deployment model.
   • Maintain an inventory and versioning dashboard for self-hosted AI platforms (including Open WebUI) and subscribe to upstream security advisories.

References

1. NVD — CVE-2026-87995: https://nvd.nist.gov/vuln/detail/CVE-2026-87995
2. Open WebUI upstream project / release notes for version 0.11.1 (vendor fix referenced in the NVD description)
3. MDN Web Docs — iframe sandbox attribute and the allow-scripts + allow-same-origin warning: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe
4. CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-87995 is NOT listed; no exploit-in-the-wild evidence as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / in-the-wild note: No threat actor campaigns, public PoC, exploit code, or KEV listing are associated with CVE-2026-87995 in the data provided. EPSS is not yet scored by FIRST.org, and no EPSS value should be assumed.