EUVD-2026-38525
GHSA-jrfp-m64g-pcwv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain low-priv Open WebUI account
-
DeliveryStand up public redirector returning 302 to internal target
-
ExploitSubmit attacker URL via Web Search/URL Loader
-
InstallSafePlaywrightURLLoader validates only outer hostname
-
C2Playwright follows redirect to 169.254.169.254 or internal service
-
ExecuteResponse (including IAM credentials) returned through RAG output
-
ImpactPivot using stolen credentials or harvested internal data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) an Open WebUI deployment at version <= 0.9.5 with RAG_WEB_LOADER_ENGINE=playwright explicitly configured - the default loader is not affected, (2) a low-privileged authenticated account (PR:L) able to submit a URL through the Web Search or URL Loader RAG feature, (3) outbound HTTP egress from the Open WebUI host so the headless browser can reach the attacker's redirector, and (4) at least one reachable internal target of value (cloud IMDS endpoint at 169.254.169.254, a co-located Docker/Kubernetes service, or an unauthenticated intranet admin panel). Exploitation is LIMITED by: ENABLE_RAG_LOCAL_WEB_FETCH=False is the default and is the very control being bypassed, so deployments that have disabled the URL Loader feature entirely or restricted it to admins are not exposed; no user interaction beyond the attacker's own submission is required (UI:N); the data exfiltration channel is whatever Open WebUI displays/indexes from the fetched page, so binary protocols or services that don't return HTTP-renderable content are harder to abuse. |
| Impact | The published CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N (7.7 High) aligns with the technical facts: exploitation is network-reachable, low-complexity, and requires only a low-privileged authenticated Open WebUI account that can submit a URL to the Web Search / URL Loader feature; scope changes because the SSRF reaches services outside Open WebUI's security authority, and confidentiality impact is High due to potential theft of cloud IMDS credentials. Integrity and Availability are marked N, which is conservative - in practice the SSRF could enable unauthenticated POSTs to internal admin APIs, so real-world integrity impact may exceed the rated value. No EPSS score, KEV listing, or wider exploitation telemetry was provided, and no public exploit identified at time of analysis beyond the PoC in the advisory itself; real-world priority is moderate-to-high for any Open WebUI deployment that (a) runs in a cloud VM with IMDSv1, (b) shares a Docker/Kubernetes network with sensitive services, or (c) allows untrusted users to register accounts. Note that exploitation is gated by the non-default but commonly used RAG_WEB_LOADER_ENGINE=playwright setting; deployments using other loader engines are not affected by this specific code path. |
| Exploit ScenarioDerived | An attacker with any logged-in Open WebUI account stands up a public web server (e.g., http://attacker.example/) that returns HTTP 302 redirects to http://169.254.169.254/latest/meta-data/iam/security-credentials/ or to an internal container such as http://open-webui:8080/api/version. They submit that URL via the Web Search or URL Loader feature; Playwright validates only the attacker domain, then follows the redirect and fetches the internal resource, exposing the response body (and any IAM credentials) back through the RAG indexing/output flow. A functional PoC using Flask and Docker is published in the GHSA advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 18, 2026
SSRF protection bypass in Open WebUI's SafePlaywrightURLLoader (versions <= 0.9.5) allows authenticated users to access internal network resources by supplying an externally-hosted URL that returns an HTTP 301/302 redirect to a private address. Because Playwright's page.goto() automatically follows redirects without re-validating the destination, attackers can reach localhost, container-network peers, or cloud metadata endpoints (169.254.169.254) even when ENABLE_RAG_LOCAL_WEB_FETCH=False. A working PoC is published in the GHSA advisory; there is no public exploit identified at time of analysis being actively used, and no CISA KEV listing.
RemediationAI
Vendor-released patch: upgrade open-webui to 0.9.6 or later, which adds a Playwright page.route('**/*', ...) interceptor that re-runs validate_url for every request including redirects (see https://github.com/open-webui/open-webui/security/advisories/GHSA-jrfp-m64g-pcwv). If immediate upgrade is not possible, switch RAG_WEB_LOADER_ENGINE to a non-Playwright loader (e.g., the requests-based engine) which is not affected by this redirect-follow behavior, accepting the trade-off of losing JavaScript rendering for fetched pages. As compensating controls, restrict outbound egress from the Open WebUI container/VM via network policy or an egress proxy to block traffic to RFC1918 ranges, 127.0.0.0/8, and 169.254.169.254, force IMDSv2 on AWS hosts to require a session token the browser will not send, and limit Web Search / URL Loader use to trusted accounts via Open WebUI's RBAC; these mitigations reduce blast radius but do not close the SSRF in-process and may break legitimate internal-knowledge-base integrations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Open WebUI is a self-hosted Python web interface for LLM backends distributed via pip. Its Retrieval-Augmented Generation (RAG) feature lets users submit URLs to be fetched and indexed; the SafePlaywrightURLLoader is one of several configurable web-loader engines (selected via RAG_WEB_LOADER_ENGINE=playwright) and uses the Playwright headless-browser library to render JavaScript-heavy pages. The flaw is a classic CWE-918 (Server-Side Request Forgery) instance caused by Time-of-Check / Time-of-Use divergence: _safe_process_url_sync() resolves and validates only the user-supplied URL against a private-IP denylist, but the subsequent page.goto() call uses Playwright's default behavior of transparently following HTTP 3xx redirects, so a 302 from an attacker-controlled host pointing at 127.0.0.1, an internal container DNS name, or the cloud IMDS endpoint is fetched without revalidation. The recommended fix uses Playwright's page.route('**/*', interceptor) hook to re-run validate_url on every individual request the browser issues, including redirects.
Know when Docker gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network-reachable feature requires a low-priv authenticated user (PR:L), no UI; SSRF crosses scope to internal services (S:C) with high confidentiality impact (IMDS creds) and low integrity from possible internal write requests.
Primary rating from Vendor (https://github.com/open-webui/open-webui).
CVSS VectorVendor: https://github.com/open-webui/open-webui
DescriptionCVE.org
Summary
The SafePlaywrightURLLoader implements a validate_url function to prevent SSRF attacks by checking the IP address of the user-provided URL. However, this validation is performed only on the initial URL.
Since Playwright automatically follows HTTP redirects (301/302) by default, an attacker can bypass the validation by providing a safe URL that redirects to a restricted internal network address (e.g., localhost, Docker container network, or Cloud Metadata).
This allows the application to access internal services despite ENABLE_RAG_LOCAL_WEB_FETCH being set to False
Details
Root Cause
The application validates the initial user-provided URL using self._safe_process_url_sync(url). This correctly resolves the domain and ensures it does not point to a private IP.
The application then calls page.goto(url). By default, Playwright automatically follows HTTP redirects (301/302).
The Bypass: If the destination server returns a redirect to an internal IP (e.g., 127.0.0.1 or 169.254.169.254), the browser follows it without re-validating the new destination. The initial validation is bypassed because it only checked the first URL, not the entire redirect chain.
for url in self.urls:
try:
self._safe_process_url_sync(url)
page = browser.new_page()
response = page.goto(url, timeout=self.playwright_timeout) #this
if response is None:
raise ValueError(...)
text = self.evaluator.evaluate(page, browser, response)PoC
(This PoC uses Docker to easily demonstrate internal network access (accessing a container by service name). However, the vulnerability is NOT tied to Docker.)
- Ensure the Open WebUI is configured with the following environment variables. The vulnerability is specific to the Playwright engine.
- ENABLE_RAG_LOCAL_WEB_FETCH=False (Default)
- RAG_WEB_LOADER_ENGINE=playwright
- Setup and run attack server
- In Open WebUI, use the "Web Search" or "URL Loader" feature.
- Input the attacker's URL (e.g., http://attacker-ip/).
# attack_server.py
from flask import Flask, redirect
app = Flask(__name__)
@app.route('/')
def attack():
# Redirect to the Open WebUI container's internal port
return redirect("http://open-webui:8080/api/version", code=302)
if __name__ == '__main__':
app.run(host='0.0.0.0', port=80)<img width="580" height="192" alt="image" src="https://github.com/user-attachments/assets/4600dbb5-a81d-4e58-b787-afe04fe59d6e" />
The Playwright browser follows the redirect to the internal address (http://open-webui:8080/api/version)
Impact
+ Cloud Environments: Access to Instance Metadata Service (IMDS) to steal cloud credentials. + Intranet/On-Premise: Scanning internal networks and accessing unauthenticated internal tools. + Container Environments: Accessing other containers within the same network.
Recommended Patch
implement a request interceptor using Playwright's page.route. This ensures all requests, including redirects, are validated before connection.
apply the following logic to both lazy_load and alazy_load methods:
# async context
async def intercept_route(route):
try:
await run_in_threadpool(validate_url, route.request.url)
await route.continue_()
except Exception:
await route.abort()
await page.route("**/*", intercept_route)
response = await page.goto(url, timeout=self.playwright_timeout)Articles & Coverage 1
Executive ViewAI
Open WebUI versions 0.9.5 and earlier contain an authenticated vulnerability allowing authorized users to bypass network isolation controls and access internal infrastructure, including cloud credential endpoints. This exposes organizations to lateral movement and data exfiltration by trusted users or through compromised accounts. Immediate assessment of user access permissions and interim network protections are required pending vendor remediation.
Implement network segmentation via firewall or container orchestration policies to block egress from Open WebUI containers to cloud metadata endpoints (169.254.169.254) and internal network ranges; disable ENABLE_RAG_LOCAL_WEB_FETCH if RAG functionality is not operationally required; monitor application logs for suspicious HTTP redirect patterns to private addresses; restrict Open WebUI access to required personnel only and enforce strong access controls.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Unauthenticated remote command injection in SGWBOX N3 firmware 2.0.25 lets attackers execute arbitrary operating-system
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Exploit-DB