THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-70490 (MEDIUM 6.3) — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/open_webui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that get_ve

[NVD] CVE-2026-70490 (MEDIUM 6.3) — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/open_webui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that get_ve

lownvdPublished 2026-08-04

CVE-2026-70490 CVSS: 6.3 MEDIUM Published: 2026-08-04T21:16:37.910

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/open_webui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that get_verified_user enforces on HTTP terminal routes. An acc

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-70490