EUVD-2026-75187
GHSA-5x7x-4c3c-qf5w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Cloud IMDS exposure via SSRF can yield IAM credentials (C:H); S:C retained because the fetch reaches beyond the vulnerable system boundary.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEB_FETCH_FILTER_LIST or private-address controls to HTTP redirect destinations when AIOHTTP_CLIENT_ALLOW_REDIRECTS was enabled. An authenticated user could redirect the aiohttp and requests fetch paths to excluded hosts, loopback, private networks, or cloud metadata services and route resulting content into web search, URL ingestion, page-fetch tools, or chat image processing. This issue is fixed in version 0.11.1.
AnalysisAI
SSRF filter-bypass in Open WebUI 0.9.5-0.11.0 allows authenticated users to route server-side fetches to private networks, loopback addresses, and cloud metadata endpoints by exploiting unvalidated HTTP redirect destinations. When AIOHTTP_CLIENT_ALLOW_REDIRECTS is enabled, the platform applies WEB_FETCH_FILTER_LIST and private-address controls only to the initial request URL, not to redirect hops - allowing a crafted redirect chain to reach AWS IMDS, Azure platform channels, or internal services. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a valid Open WebUI user account (PR:L - unauthenticated access is not possible); (2) AIOHTTP_CLIENT_ALLOW_REDIRECTS must be enabled in the deployment configuration, as redirect-following is the mechanism that bypasses the filter; (3) the attacker must control an intermediate HTTP server capable of issuing a redirect to the target internal address; (4) the target internal address (e.g., IMDS, loopback service) must be reachable from the Open WebUI server's network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score of 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) is arguably understated for cloud-hosted deployments: SSRF reaching AWS IMDSv1 or Azure IMDS can expose IAM role credentials or managed-identity tokens, representing a confidentiality impact closer to C:H than C:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Open WebUI v0.11.1, released at https://github.com/open-webui/open-webui/releases/tag/v0.11.1; this is the sole vendor-confirmed fix and directly addresses the redirect-filter bypass via the changes in PR #27823 (commit e3e4bd87). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today