Open WebUI CVE-2026-88001

Exploitation requires (1) a valid Open WebUI user account (PR:L - unauthenticated access is not possible); (2) AIOHTTP_CLIENT_ALLOW_REDIRECTS must be enabled in the deployment configuration, as redirect-following is the mechanism that bypasses the filter; (3) the attacker must control an intermediate HTTP server capable of issuing a redirect to the target internal address; (4) the target internal address (e.g., IMDS, loopback service) must be reachable from the Open WebUI server's network. Exploitation is limited to confidentiality - the CVSS I:N/A:N vector confirms no write or denial-of-service capability through this path alone. On-premises deployments without cloud metadata services present a reduced but non-zero risk (internal APIs, admin panels on private subnets remain reachable).

The vendor-assigned CVSS 3.1 score of 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) is arguably understated for cloud-hosted deployments: SSRF reaching AWS IMDSv1 or Azure IMDS can expose IAM role credentials or managed-identity tokens, representing a confidentiality impact closer to C:H than C:L. The scope-change flag (S:C) correctly captures that the vulnerable system acts as a proxy into adjacent systems. The attack complexity is genuinely low - constructing an HTTP redirect to an internal target requires no special tooling. Exploitation requires at least basic user authentication (PR:L), limiting the attack surface to registered platform users. No public PoC and no KEV listing indicate opportunistic mass exploitation is not currently occurring, but targeted abuse by a malicious insider or compromised account is plausible in any cloud-hosted instance. Deployments running with ENABLE_LOCAL_WEB_FETCH=true or a permissive WEB_FETCH_FILTER_LIST face lower residual risk after patching because those settings already reduced the blocked surface; conversely, deployments that relied entirely on the filter list to protect sensitive internal endpoints were most exposed.

An authenticated Open WebUI user with access to the URL ingestion or web-fetch feature submits a URL pointing to an attacker-controlled server. That server returns an HTTP 302 redirect to http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS IMDSv1). Because AIOHTTP_CLIENT_ALLOW_REDIRECTS is enabled and the redirect destination is not re-validated against WEB_FETCH_FILTER_LIST, the Open WebUI backend fetches the metadata endpoint and surfaces the IAM role credential JSON in the chat or retrieval result, delivering temporary AWS access keys to the attacker. No public exploit code is confirmed at time of analysis.