What happened
CVE-2026-87015 (CVSS 6.8, medium) affects Open WebUI from 0.6.27 until 0.11.1. backend/open_webui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it per external tool callable; when multiple tool servers were attached, cookies/session state from one external tool server's connection could leak into requests intended for a different tool server.
Why it matters
Open WebUI's external tool-server integration is the mechanism by which the LLM interacts with outside services; a cookie-jar mix-up across tool servers can cause session/authentication material intended for one integrated tool to be sent to a different one, creating a cross-tool credential-leakage risk in exactly the kind of multi-tool agentic configuration that OWASP and others flag as the emerging high-risk agentic surface.
Attack vector
When multiple external tool servers are configured, the shared connection-loop cookie jar in tools.py can leak session cookies from one tool server's requests into another's, exposing session state across tool boundaries.
Affected systems
Open WebUI versions 0.6.27 until 0.11.1 with multiple external tool servers attached
Mitigation
Upgrade to Open WebUI 0.11.1 or later per the linked fix commit.