{"items":[{"id":"NVI-00014037","kind":"vulnerability","title":"Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-p78m-89r6-pgf7","CVE-2026-87015"],"plain_summary":"GitHub lists this reviewed advisory for open-webui. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-36480c812dfee225b5f4bd338a89568b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-10T21:23:45.000Z","value":"6.8 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-36480c812dfee225b5f4bd338a89568b"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-36480c812dfee225b5f4bd338a89568b","url":"https://github.com/advisories/GHSA-p78m-89r6-pgf7","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-p78m-89r6-pgf7","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T22:54:05.264Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-36480c812dfee225b5f4bd338a89568b"],"technology":"open-webui","known_exclusions":[],"conditions_summary":"## Summary\n\nWhen more than one external tool server is reachable in the same request, a tool call to a server configured for bearer authentication can arrive carrying the calling user's Open WebUI session cookies alongside that server's own key. The cookie jar is built per connection, but the callable that performs the request reads it late instead of per connection, so every tool callable built in the same pass sends the cookies belonging to whichever connection was processed last. An administrator who configures a server with its own API key has not chosen to send that server anything else, and the operator of that server receives a live session credential for the user who triggered the call.\n\n## Preconditions\n\nAt least two external tool servers must be attached to the same request, and at least one of them must be set to session or system OAuth authentication, since no cookie jar is assembled otherwise. The connection using that authentication mode must be the one processed last, which follows the order of the tool servers attached to the request rather than anything the receiving party controls.\n\nA deployment with no tool servers, with only one tool server, or where no attached","public_affected_ranges":[">= 0.6.27, < 0.11.1"]}],"null_published_at":"2026-11-02T10:00:37.199Z","source_updated_at":"2026-09-10T21:23:45.000Z","source_disclosed_at":"2026-09-10T21:23:44.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T22:54:05.264Z"}],"next_cursor":null,"snapshot_revision":"42594"}