CVE-2026-45317: Open WebUI CSRF Vulnerability

CVE-2026-45317 Overview

CVE-2026-45317 is a Cross-Site Request Forgery (CSRF) vulnerability in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. The flaw affects the image uploading functionality in versions prior to 0.9.3. An attacker can set an image URL to a malicious endpoint, causing any user who views the compromised image — such as a profile picture — to unknowingly send a GET request to the attacker-controlled URL. The issue is tracked under [CWE-20: Improper Input Validation] and is fixed in version 0.9.3.

Critical Impact
Exploitation can lead to cookie theft, denial of service, or unauthorized actions performed on behalf of victim users across the application.

Affected Products

Open WebUI versions prior to 0.9.3
Self-hosted Open WebUI deployments exposing image upload features
Multi-user Open WebUI instances with profile picture functionality

Discovery Timeline

2026-05-15 - CVE-2026-45317 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-45317

Vulnerability Analysis

The vulnerability resides in Open WebUI's image upload functionality. The application allows authenticated users to specify an image URL rather than uploading an image file directly. The server or client subsequently fetches that URL when rendering the image, including profile pictures shown to other users.

Because the request is issued in the context of the viewer's session, the attacker can abuse this behavior to trigger unwanted GET requests against arbitrary endpoints. The vulnerability is application-wide, meaning any feature that displays the attacker-supplied image can become a CSRF trigger. Any authenticated user can plant such an image, and any subsequent viewer becomes a victim.

Root Cause

The root cause is improper input validation [CWE-20] on user-supplied image URLs. Open WebUI does not adequately restrict the destination of these URLs and does not sanitize or proxy the resulting request to remove session credentials or limit targets. As a result, image rendering doubles as an arbitrary outbound HTTP GET primitive scoped to the viewer's authenticated context.

Attack Vector

Exploitation requires network access and low-privilege authentication, with user interaction needed to view the malicious image. An authenticated attacker sets their profile image or message-embedded image URL to a controlled endpoint. When a victim user loads a page that renders that image, their browser or the Open WebUI backend issues a GET request to the attacker's server. The attacker can then capture forwarded cookies or referrers, deliver oversized payloads to cause denial of service, or chain the request into other CSRF-sensitive endpoints. No verified public proof-of-concept exploit is currently available.

Detection Methods for CVE-2026-45317

Indicators of Compromise

Outbound HTTP GET requests from Open WebUI hosts or user browsers to unfamiliar external domains triggered by profile image loads.
Profile picture or chat image URLs pointing to non-image endpoints, including IP literals or unusual TLDs.
Unexpected spikes in egress traffic correlated with rendering of user-generated content in Open WebUI.

Detection Strategies

Audit the Open WebUI database and configuration for user profile_image_url values that do not point to trusted image hosts.
Review reverse proxy and web server logs for outbound fetches originating from the Open WebUI service to non-image content types.
Inspect browser-side logs and CSP violation reports for image loads from domains outside an approved allow list.

Monitoring Recommendations

Forward Open WebUI access and application logs to a centralized logging platform for correlation with network egress telemetry.
Alert on Open WebUI making outbound connections to newly observed or low-reputation domains.
Track Open WebUI version inventory and flag any instance running a release earlier than 0.9.3.

How to Mitigate CVE-2026-45317

Immediate Actions Required

Upgrade all Open WebUI instances to version 0.9.3 or later, which contains the official fix.
Reset or sanitize existing user profile image URLs to ensure no attacker-controlled endpoints remain stored.
Restrict Open WebUI exposure to trusted networks until patching is complete, particularly for multi-tenant deployments.

Patch Information

The vulnerability is fixed in Open WebUI 0.9.3. Refer to the Open WebUI GitHub Security Advisory GHSA-j6w6-986j-2m2m for vendor-supplied remediation details and upgrade instructions.

Workarounds

Place Open WebUI behind a reverse proxy that enforces a strict outbound allow list for image fetches.
Disable user-modifiable profile pictures and external image URL fields until the upgrade is applied.
Apply a Content Security Policy that restricts img-src to trusted hosts to limit browser-side CSRF impact.

bash

# Configuration example: upgrade Open WebUI container to the patched release
docker pull ghcr.io/open-webui/open-webui:0.9.3
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.9.3