This is my first GitHub issue. Apologies in advance if any conventions are off.
Summary
In Multi-User mode for the integrated terminal, the sidebar file browser lets any unprivileged user read arbitrary files in the container regardless of Linux permissions. This includes /proc/1/environ, which exposes the OPEN_TERMINAL_API_KEY and any other env-injected secrets, plus anything else outside the user's /home/ directory. Only other users home directories seem to be invisible. Per-user isolation is effectively bypassed.
Steps to reproduce
- Start with OPEN_TERMINAL_MULTI_USER=true and a fixed API key.
- Connect as a non-admin user and confirm isolation works in the terminal:
whoami -> u02cb5cf0 (uid 1002)
cat /proc/1/environ -> Permission denied
- Open /proc/1/environ via the file browser sidebar.
=> Result: the full content including the API key is shown. The same applies to any other files outside of other home directories. Expected: Permission denied, matching the terminal.
Likely root cause
The file browser appears to perform with elevated privileges instead of as the requesting user. This maybe defeats the other documented secret methods too (OPEN_TERMINAL_API_KEY_FILE, mounted config.toml, Docker Swarm secrets), since they all end up as files inside the container.
Image: ghcr.io/open-webui/open-terminal:latest
Open WebUI version: v0.9.2
Open Terminal Docker v0.11.34
Host: Ubuntu 26.04 in a Proxmox LXC
Multi-User mode: enabled
This is my first GitHub issue. Apologies in advance if any conventions are off.
Summary
In Multi-User mode for the integrated terminal, the sidebar file browser lets any unprivileged user read arbitrary files in the container regardless of Linux permissions. This includes /proc/1/environ, which exposes the OPEN_TERMINAL_API_KEY and any other env-injected secrets, plus anything else outside the user's /home/ directory. Only other users home directories seem to be invisible. Per-user isolation is effectively bypassed.
Steps to reproduce
whoami -> u02cb5cf0 (uid 1002)
cat /proc/1/environ -> Permission denied
=> Result: the full content including the API key is shown. The same applies to any other files outside of other home directories. Expected: Permission denied, matching the terminal.
Likely root cause
The file browser appears to perform with elevated privileges instead of as the requesting user. This maybe defeats the other documented secret methods too (OPEN_TERMINAL_API_KEY_FILE, mounted config.toml, Docker Swarm secrets), since they all end up as files inside the container.
Image: ghcr.io/open-webui/open-terminal:latest
Open WebUI version: v0.9.2
Open Terminal Docker v0.11.34
Host: Ubuntu 26.04 in a Proxmox LXC
Multi-User mode: enabled