EUVD-2026-75187
GHSA-5x7x-4c3c-qf5w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Cloud IMDS exposure via SSRF can yield IAM credentials (C:H); S:C retained because the fetch reaches beyond the vulnerable system boundary.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEB_FETCH_FILTER_LIST or private-address controls to HTTP redirect destinations when AIOHTTP_CLIENT_ALLOW_REDIRECTS was enabled. An authenticated user could redirect the aiohttp and requests fetch paths to excluded hosts, loopback, private networks, or cloud metadata services and route resulting content into web search, URL ingestion, page-fetch tools, or chat image processing. This issue is fixed in version 0.11.1.
AnalysisAI
SSRF filter-bypass in Open WebUI 0.9.5-0.11.0 allows authenticated users to route server-side fetches to private networks, loopback addresses, and cloud metadata endpoints by exploiting unvalidated HTTP redirect destinations. When AIOHTTP_CLIENT_ALLOW_REDIRECTS is enabled, the platform applies WEB_FETCH_FILTER_LIST and private-address controls only to the initial request URL, not to redirect hops - allowing a crafted redirect chain to reach AWS IMDS, Azure platform channels, or internal services. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a valid Open WebUI user account (PR:L - unauthenticated access is not possible); (2) AIOHTTP_CLIENT_ALLOW_REDIRECTS must be enabled in the deployment configuration, as redirect-following is the mechanism that bypasses the filter; (3) the attacker must control an intermediate HTTP server capable of issuing a redirect to the target internal address; (4) the target internal address (e.g., IMDS, loopback service) must be reachable from the Open WebUI server's network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score of 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) is arguably understated for cloud-hosted deployments: SSRF reaching AWS IMDSv1 or Azure IMDS can expose IAM role credentials or managed-identity tokens, representing a confidentiality impact closer to C:H than C:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Open WebUI v0.11.1, released at https://github.com/open-webui/open-webui/releases/tag/v0.11.1; this is the sole vendor-confirmed fix and directly addresses the redirect-filter bypass via the changes in PR #27823 (commit e3e4bd87). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Open Webui
View allA vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session
An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the
A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui
A vulnerability in open-webui/open-webui versions <= 0.3.8 allows remote code execution by non-admin users via Cross-Sit
Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traver
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a St
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Se
A stored cross-site scripting (XSS) vulnerability exists in open-webui/open-webui version 0.3.8. Rated high severity (CV
In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing u
In open-webui version 0.3.8, the endpoint `/models/upload` is vulnerable to arbitrary file write due to improper handlin
The `/openai/models` endpoint in open-webui/open-webui version 0.3.8 is vulnerable to Server-Side Request Forgery (SSRF)
In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today