What is the CVSS score of CVE-2026-59223?

CVE-2026-59223 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-59223?

Yes, a patch is available for CVE-2026-59223. Update the affected software to the latest version immediately.

Open WebUI CVE-2026-59223

EUVD-2026-42633 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-07-09 security-advisories@github.com

GHSA-qg3f-8x3j-ggf2

Authentication Bypass Open Webui Openwebui

4.3

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.0 MEDIUM

Scope is Changed because the bypass enables server-side fetches to internal systems outside the application's intended security boundary, consistent with SSRF protection failure; PR:L confirmed by authentication requirement.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 09, 2026 - 18:01 EUVD

Analysis Generated

Jul 09, 2026 - 17:46 vuln.today

DescriptionCVE.org

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, WEB_FETCH_FILTER_LIST matching compared configured host entries against URL strings and non-label-boundary suffixes, allowing path-based blocklist bypasses such as !internal.example.com in a URL path and sibling-domain matches that did not reflect the intended hostname policy. This issue is fixed in version 0.10.0.

AnalysisAI

Open WebUI's WEB_FETCH_FILTER_LIST blocklist enforcement fails to parse hostnames at label boundaries in versions prior to 0.10.0, enabling authenticated users to bypass administrator-configured host restrictions and trigger server-side fetches to internally restricted resources. Two bypass classes exist: embedding a blocked hostname in the URL path component (e.g., https://attacker.com/internal.corp/data) rather than the authority, and using a sibling domain sharing the blocked entry's suffix (e.g., evilinternalhost.example.com matching a blocklist entry for internalhost.example.com). No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Open WebUI is a self-hosted AI platform widely used as a frontend for local LLM inference servers such as Ollama and OpenAI-compatible APIs. Its WEB_FETCH_FILTER_LIST feature provides SSRF-mitigation controls by specifying a denylist of hostnames that the platform's server-side fetch capability should not contact. CWE-693 (Protection Mechanism Failure) precisely identifies the root cause: the enforcement logic compares raw URL strings against blocklist entries rather than against properly parsed, RFC 5891-compliant label-boundary-aware hostnames. This produces two exploitable failure modes. First, a blocklisted hostname appearing as a path segment (after the authority component) is incorrectly compared against the full URL string rather than just the host, allowing the path-based bypass. Second, the suffix-matching approach fails to anchor comparisons at label boundaries, so a sibling domain sharing a suffix with a blocklisted host (e.g., evilinternalhost vs. internalhost) bypasses the rule. This effectively voids SSRF protection for deployments relying solely on WEB_FETCH_FILTER_LIST for network segmentation. Affected versions span all Open WebUI releases prior to 0.10.0; exact CPE enumeration was not present in the NVD data at time of analysis.

RemediationAI

The primary remediation is upgrading Open WebUI to version 0.10.0 or later, which corrects the hostname matching logic to enforce label-boundary comparisons, eliminating both the path-based and sibling-domain bypass classes. The underlying fix is documented in commit 087878ce848a4d828012068b5997dac480f43656 and pull request #25949 (https://github.com/open-webui/open-webui/pull/25949); the full security advisory is at https://github.com/open-webui/open-webui/security/advisories/GHSA-qg3f-8x3j-ggf2. If immediate upgrade is not feasible, administrators should implement IP-range-based network egress restrictions at the host or container level (e.g., iptables rules blocking RFC 1918 address space and cloud metadata IP ranges such as 169.254.169.254/32) rather than relying on WEB_FETCH_FILTER_LIST hostname entries, as these are not affected by the application-layer bypass. Disabling the web fetch feature entirely eliminates the attack surface at the cost of that functionality. Restricting Open WebUI user accounts to trusted operators only limits the pool of users who can trigger fetch operations.