CVE-2026-45331: Open WebUI SSRF Bypass Vulnerability

CVE-2026-45331 Overview

CVE-2026-45331 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. Versions prior to 0.9.0 contain a broken URL validation routine in backend/open_webui/retrieval/web/utils.py. The validate_url() function fails to block private IPv6 addresses and several reserved IPv4 ranges, allowing authenticated attackers to coerce the server into making requests to internal network resources. Open WebUI released a fix in version 0.9.0.

Critical Impact
Authenticated attackers can pivot through the Open WebUI server to access internal services, cloud metadata endpoints, and otherwise unreachable infrastructure.

Affected Products

Open WebUI versions prior to 0.9.0
Self-hosted deployments using backend/open_webui/retrieval/web/utils.py
Open WebUI retrieval and web fetching features

Discovery Timeline

2026-05-15 - CVE-2026-45331 published to NVD
2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-45331

Vulnerability Analysis

The vulnerability resides in the validate_url() function inside backend/open_webui/retrieval/web/utils.py. This function is responsible for ensuring that user-supplied URLs do not point to private, loopback, or otherwise restricted address ranges before the server initiates outbound HTTP requests. The filter is bypassed in three distinct ways, allowing an attacker to direct the backend toward internal targets.

Open WebUI is commonly deployed alongside model backends, vector databases, and cloud infrastructure. A working SSRF primitive in this position exposes cloud instance metadata services, internal admin panels, and lateral-movement targets that would not otherwise be reachable from the public internet.

Root Cause

The core defect is incorrect use of the validators Python library. The code calls validators.ipv6(ip, private=True), but the validators library does not implement the private keyword for IPv6 addresses. Instead of validating, the call raises a ValidationError. Because ValidationError is falsy in a boolean context, the conditional treats every IPv6 address as passing the filter.

Two additional gaps compound the issue. IPv4-mapped IPv6 addresses such as ::ffff:10.0.0.1 skip the IPv4 check entirely. Several reserved IPv4 ranges, including 0.0.0.0/8, 100.64.0.0/10, and 192.0.0.0/24, are not enumerated in the deny list.

Attack Vector

An authenticated user submits a URL containing an IPv6 address, an IPv4-mapped IPv6 address, or an IP in one of the unblocked reserved ranges. The server accepts the URL and issues an HTTP request to the target. Attackers can reach the IMDS endpoint at 169.254.169.254 via IPv4-mapped IPv6, query internal services bound to IPv6 loopback ::1, or scan RFC 6598 carrier-grade NAT space.

The vulnerability is described in prose only — refer to the GitHub Security Advisory GHSA-4v7r-f4w8-8972 for the full technical breakdown and patch diff.

Detection Methods for CVE-2026-45331

Indicators of Compromise

Outbound HTTP requests from the Open WebUI process targeting IPv6 addresses, particularly ::1, fc00::/7, or ::ffff:0:0/96 mapped ranges
Requests from the Open WebUI host to cloud metadata endpoints such as 169.254.169.254 or fd00:ec2::254
Connections from Open WebUI to RFC 1918, RFC 6598 (100.64.0.0/10), or 0.0.0.0/8 destinations
Unusual web-retrieval requests containing IPv6 literals or IPv4-mapped IPv6 syntax in user input

Detection Strategies

Inspect Open WebUI application logs for validate_url() calls that succeed against IPv6 or reserved IPv4 destinations
Monitor egress traffic from the Open WebUI container or host for connections to non-routable internal ranges
Correlate authenticated user activity in Open WebUI with outbound requests to internal infrastructure

Monitoring Recommendations

Enable network flow logging on the subnet hosting Open WebUI and alert on traffic to cloud metadata IPs
Capture and retain Open WebUI access logs to associate SSRF attempts with specific user sessions
Deploy egress filtering at the host or container boundary and alert when blocked connections originate from the AI platform

How to Mitigate CVE-2026-45331

Immediate Actions Required

Upgrade Open WebUI to version 0.9.0 or later, which corrects the validate_url() logic
Restrict outbound network access from the Open WebUI host using firewall or security group rules that deny RFC 1918, RFC 6598, link-local, and IPv6 private ranges
Disable or restrict web retrieval features for non-administrative users until patching is complete
Rotate any credentials accessible via the cloud metadata service if compromise is suspected

Patch Information

Open WebUI version 0.9.0 fixes the issue by correctly validating IPv6 addresses, handling IPv4-mapped IPv6 forms, and expanding the reserved IPv4 block list. Review the GitHub Security Advisory GHSA-4v7r-f4w8-8972 for full remediation details.

Workarounds

Place Open WebUI behind an egress proxy that enforces a strict allow-list of outbound destinations
Configure cloud instance metadata service v2 (IMDSv2) with hop limit of 1 to defeat SSRF against metadata endpoints
Deploy Open WebUI on a network segment with no route to internal management interfaces or sensitive backends
Drop IPv6 connectivity from the Open WebUI host if it is not required for operations

bash

# Configuration example: restrict Open WebUI egress with iptables
iptables -A OUTPUT -m owner --uid-owner openwebui -d 169.254.169.254 -j DROP
iptables -A OUTPUT -m owner --uid-owner openwebui -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner openwebui -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner openwebui -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -m owner --uid-owner openwebui -d 100.64.0.0/10 -j DROP
ip6tables -A OUTPUT -m owner --uid-owner openwebui -d ::1/128 -j DROP
ip6tables -A OUTPUT -m owner --uid-owner openwebui -d fc00::/7 -j DROP