What is the CVSS score of EUVD-2026-52900?

EUVD-2026-52900 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-52900?

Yes, a patch is available for EUVD-2026-52900. Update the affected software to the latest version immediately.

Open WebUI EUVD-2026-52900

| CVE-2026-54020 MEDIUM

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-08-04 GitHub_M

GHSA-h6x2-583h-x99r

Information Disclosure Open Webui

6.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.3 MEDIUM

DNS rebinding race requires timing control and DNS authority (AC:H), authenticated account (PR:L), reaches internal systems beyond application scope (S:C), leaks confidential data with no integrity or availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 04, 2026 - 21:02 vuln.today

Analysis Generated

Aug 04, 2026 - 21:02 vuln.today

Patch available

Aug 04, 2026 - 21:01 EUVD

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on open-webui (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.11.0.

DescriptionCVE.org

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL validation and rejected private, loopback, and link-local addresses, but the HTTP clients resolved the hostname again at connection time. An authenticated attacker who controlled authoritative DNS for a submitted hostname could answer with a public address during validation and an internal one during connection, reaching cloud metadata, loopback admin APIs, or internal services through URL ingest, chat image_url fetches, image editing, or OAuth profile-picture fetches, with most paths returning the response to the attacker and the OAuth path forwarding the OAuth access token. This issue is fixed in 0.11.0.

AnalysisAI

DNS rebinding bypasses Open WebUI's SSRF protection in all versions prior to 0.11.0, enabling authenticated attackers who control authoritative DNS for a submitted hostname to reach internal resources - including cloud instance metadata services (e.g., 169.254.169.254), loopback admin APIs, and internal network services. The root cause is a TOCTOU race: the hostname is resolved once for validation and again at connection time, letting a TTL=0 DNS record switch from a public IP during the check to an internal IP during the actual fetch. On most vulnerable paths the internal response is returned directly to the attacker; the OAuth path additionally forwards the OAuth access token as a Bearer header to the attacker-controlled internal target, enabling credential theft. No public exploit identified at time of analysis.

Technical ContextAI

The vulnerability is a classic DNS rebinding / TOCTOU flaw (CWE-367) in Open WebUI's URL validation pipeline. The affected code resolves a user-supplied hostname once, checks the resulting IP against a blocklist of private (RFC 1918), loopback, and link-local ranges, then passes the original hostname to an HTTP client which re-resolves it independently at connection time. An attacker controlling authoritative DNS for the submitted hostname can serve TTL=0 records alternating between a public IP (to clear the blocklist check) and an internal IP (to redirect the actual HTTP connection). The CPE cpe:2.3:a:open-webui:open-webui:*:*:*:*:*:*:*:* covers all releases; the pip package is confirmed vulnerable through 0.10.2. Four distinct entry points are affected: URL ingest for document retrieval, image_url fields in chat completions, image editing, and OAuth profile-picture fetches. The fix in v0.11.0 (PRs #24759, #25775, #25960, #26699) eliminates the race by enforcing the IP blocklist at the connection layer rather than as a pre-flight check.

RemediationAI

Upgrade Open WebUI to version 0.11.0 or later (pip install --upgrade open-webui), which resolves the TOCTOU race by enforcing the IP blocklist at the connection layer rather than as a pre-flight DNS check; see the vendor advisory at https://github.com/open-webui/open-webui/security/advisories/GHSA-h6x2-583h-x99r and release notes at https://github.com/open-webui/open-webui/releases/tag/v0.11.0. If immediate upgrade is not feasible, restrict instance access to known-trusted authenticated users only, as any account can attempt exploitation with no elevated rights. Additionally, enable IMDSv2 (token-required mode) on AWS - or the equivalent session-token-based metadata service on GCP and Azure - to deny cloud credential access even if SSRF succeeds; note this does not protect loopback admin APIs or internal services. Disabling or restricting OAuth login eliminates the token-forwarding path specifically, though the other three ingest paths remain affected without upgrading.