EUVD-2026-52900
GHSA-h6x2-583h-x99r
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
DNS rebinding race requires timing control and DNS authority (AC:H), authenticated account (PR:L), reaches internal systems beyond application scope (S:C), leaks confidential data with no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3Blast Radius
ecosystem impact- 1 pypi packages depend on open-webui (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.11.0.
DescriptionCVE.org
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL validation and rejected private, loopback, and link-local addresses, but the HTTP clients resolved the hostname again at connection time. An authenticated attacker who controlled authoritative DNS for a submitted hostname could answer with a public address during validation and an internal one during connection, reaching cloud metadata, loopback admin APIs, or internal services through URL ingest, chat image_url fetches, image editing, or OAuth profile-picture fetches, with most paths returning the response to the attacker and the OAuth path forwarding the OAuth access token. This issue is fixed in 0.11.0.
AnalysisAI
DNS rebinding bypasses Open WebUI's SSRF protection in all versions prior to 0.11.0, enabling authenticated attackers who control authoritative DNS for a submitted hostname to reach internal resources - including cloud instance metadata services (e.g., 169.254.169.254), loopback admin APIs, and internal network services. The root cause is a TOCTOU race: the hostname is resolved once for validation and again at connection time, letting a TTL=0 DNS record switch from a public IP during the check to an internal IP during the actual fetch. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | A valid authenticated account on the Open WebUI instance is required; no administrator rights and no non-default configuration are needed for the URL ingest, image_url, and image-editing entry points. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.3 vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N accurately reflects the mechanics: network-exploitable via any browser-reachable Open WebUI instance, but AC:H correctly captures that exploiting the DNS rebinding race requires timing control the attacker influences (via TTL=0) but does not guarantee. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Open WebUI to version 0.11.0 or later (pip install --upgrade open-webui), which resolves the TOCTOU race by enforcing the IP blocklist at the connection layer rather than as a pre-flight DNS check; see the vendor advisory at https://github.com/open-webui/open-webui/security/advisories/GHSA-h6x2-583h-x99r and release notes at https://github.com/open-webui/open-webui/releases/tag/v0.11.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Open Webui
View allA vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session
An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the
A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui
A vulnerability in open-webui/open-webui versions <= 0.3.8 allows remote code execution by non-admin users via Cross-Sit
Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traver
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a St
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Se
A stored cross-site scripting (XSS) vulnerability exists in open-webui/open-webui version 0.3.8. Rated high severity (CV
In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing u
In open-webui version 0.3.8, the endpoint `/models/upload` is vulnerable to arbitrary file write due to improper handlin
The `/openai/models` endpoint in open-webui/open-webui version 0.3.8 is vulnerable to Server-Side Request Forgery (SSRF)
In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today