What is CVE-2026-70490?
CVE-2026-70490 is a vulnerability in the Open WebUI self-hosted AI platform affecting versions 0.8.8 through 0.11.0. The terminal WebSocket `route` only authenticated the initial JWT message without applying the verified user role check from `get_verified_user`, potentially bypassing access controls. Users should upgrade to a version after 0.11.0 immediately.
Azərbaycanca: CVE-2026-70490 Open WebUI self-hosted AI platformasının 0.8.8-dən 0.11.0 versiyasına qədər terminal WebSocket `route`-unda aşkarlanmış boşluqdur. Bu zəiflik `get_verified_user` funksiyasının tətbiq etdiyi təsdiq edilmiş istifadəçi rol məhdudiyyətini keçərək, yalnız ilk mesajda JWT autentifikasiyasına etibar edir. Təsirə məruz qalan sistemlərin istifadəçiləri dərhal 0.11.0-dən yüksək versiyaya yeniləməlidir.
Related CVEs
link basis: same weakness class CWE-862; shared vendor: Open WebUI
FAQ2
Which versions of the Open WebUI platform are affected by CVE-2026-70490?
CVE-2026-70490 affects the Open WebUI self-hosted AI platform from version 0.8.8 through version 0.11.0.
What is the root cause of this vulnerability?
The vulnerability arises because the terminal WebSocket `route` only authenticates the initial JWT message, allowing it to bypass the verified user role check applied by the `get_verified_user` function.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.