EUVD-2026-40451
GHSA-v376-5ppg-xp5v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint, low-privilege auth required (PR:L), scope change to internal services (S:C), limited confidentiality impact only; no integrity or availability impact confirmed.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentially execute commands via instance secrets.
AnalysisAI
Server-side request forgery in Open WebUI before 0.6.27 enables authenticated users to bypass SSRF protections in the web retrieval endpoint by supplying URLs that trigger server-side HTTP redirects to internal network resources. The /api/v1/retrieval/process/web endpoint follows Location redirect headers without revalidating the destination against SSRF blocklists, exposing internal services and potentially instance secrets that could enable command execution. No public exploit code or active exploitation has been identified at time of analysis, but the authenticated escalation path to internal infrastructure warrants prompt patching.
Technical ContextAI
Open WebUI is an open-source self-hosted web interface for large language models that includes a retrieval-augmented generation (RAG) pipeline. The /api/v1/retrieval/process/web endpoint accepts a URL parameter, fetches remote content server-side, and processes it for ingestion. The SSRF protection implemented validates the initially supplied URL but does not re-inspect the destination when the remote server issues an HTTP 3xx redirect via a Location header - a classic CWE-918 (Server-Side Request Forgery) bypass pattern. An attacker directs the server to fetch a URL on an attacker-controlled host, which responds with a redirect to an internal address (e.g., metadata services, internal APIs, or localhost-bound services). All versions captured under CPE cpe:2.3:a:open-webui:open-webui:* prior to 0.6.27 are affected with no platform restriction.
RemediationAI
Upgrade Open WebUI to version 0.6.27 or later; the fix is available via the upstream commit at https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774, which addresses the redirect-following bypass in the /api/v1/retrieval/process/web endpoint. Refer to the vendor advisory at https://github.com/open-webui/open-webui/security/advisories/GHSA-82r6-c5jm-f3mw for authoritative guidance. If immediate upgrade is not possible, block or restrict access to the /api/v1/retrieval/process/web endpoint at the reverse proxy or network layer to only trusted, known-safe users - this eliminates unauthenticated surface while retaining other functionality. Additionally, constrain outbound HTTP from the Open WebUI server host to an allowlist of known external domains using egress firewall rules, which would prevent successful redirect-to-internal-target exploitation even if the endpoint is reached. Disabling the web retrieval/RAG web fetch feature entirely via application configuration is the most conservative workaround if the feature is not operationally required.
More in Open Webui
View allA vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session
An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the
A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui
A vulnerability in open-webui/open-webui versions <= 0.3.8 allows remote code execution by non-admin users via Cross-Sit
Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traver
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a St
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Se
A stored cross-site scripting (XSS) vulnerability exists in open-webui/open-webui version 0.3.8. Rated high severity (CV
In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing u
In open-webui version 0.3.8, the endpoint `/models/upload` is vulnerable to arbitrary file write due to improper handlin
The `/openai/models` endpoint in open-webui/open-webui version 0.3.8 is vulnerable to Server-Side Request Forgery (SSRF)
In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today