CVE-2026-45338 Overview
CVE-2026-45338 is a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. The flaw resides in the _process_picture_url() function inside backend/open_webui/utils/oauth.py near line 1338. The function fetches arbitrary URLs supplied through OAuth picture claims without calling validate_url(). An authenticated attacker can force the server to issue HTTP requests to internal resources and receive the full response body. The issue affects all versions prior to 0.9.0 and is tracked under [CWE-918].
Critical Impact
Attackers can pivot through Open WebUI to reach internal services, cloud metadata endpoints, and other non-public resources, exfiltrating their full HTTP responses.
Affected Products
- Open WebUI versions prior to 0.9.0
- Deployments using OAuth-based authentication with picture claims
- Self-hosted Open WebUI instances reachable by OAuth identity providers
Discovery Timeline
- 2026-05-15 - CVE-2026-45338 published to NVD
- 2026-05-18 - Last updated in NVD database
Technical Details for CVE-2026-45338
Vulnerability Analysis
The vulnerability resides in the OAuth login flow of Open WebUI. When a user authenticates through an OAuth provider, the application processes profile claims including the picture URL. The _process_picture_url() function in backend/open_webui/utils/oauth.py fetches this URL server-side to download and store the user's avatar. The function performs the HTTP request without validating the destination URL, scheme, or host. Open WebUI ships a validate_url() helper used elsewhere to restrict outbound fetches, but this path omits the check. As a result, the server can be coerced into making arbitrary outbound HTTP requests on behalf of the attacker. The full response body is returned to the attacker context, turning the SSRF into an information disclosure primitive.
Root Cause
The root cause is missing input validation on a user-controllable URL [CWE-918]. The picture claim originates from an OAuth identity provider but is attacker-controllable in scenarios where the attacker registers a malicious identity provider, manipulates their own profile at a permissive provider, or otherwise influences the claim. Because _process_picture_url() bypasses validate_url(), internal IP ranges, link-local addresses such as 169.254.169.254, and localhost endpoints are reachable.
Attack Vector
An attacker initiates the OAuth login flow with a profile whose picture claim points to an internal URL such as a cloud metadata service, an internal admin API, or a non-public microservice. Open WebUI fetches the URL server-side and the response data is exposed back through the avatar-handling logic. No additional privileges beyond the ability to complete OAuth authentication are required.
No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-24c9-2m8q-qhmh for vendor details.
Detection Methods for CVE-2026-45338
Indicators of Compromise
- Outbound HTTP requests from the Open WebUI server process to private RFC1918 ranges, 127.0.0.0/8, or cloud metadata endpoints such as 169.254.169.254.
- OAuth login events containing picture claims pointing to internal hostnames, raw IP addresses, or non-HTTPS schemes.
- Unexpected entries in Open WebUI logs around the _process_picture_url() code path during user authentication.
Detection Strategies
- Inspect application logs for OAuth callback events and correlate them with outbound network connections initiated by the Open WebUI process within the same time window.
- Deploy egress filtering and alert on any Open WebUI host attempting connections to internal management networks or cloud instance metadata services.
- Review stored user profile picture URLs in the Open WebUI database for values pointing to internal hosts or non-public addresses.
Monitoring Recommendations
- Forward Open WebUI application and reverse-proxy logs to a centralized analytics platform and create rules for anomalous OAuth callbacks.
- Monitor network flow data from container or VM hosts running Open WebUI for connections to non-routable destinations.
- Alert on first-seen OAuth identity providers or claim issuers in environments where the provider set should be static.
How to Mitigate CVE-2026-45338
Immediate Actions Required
- Upgrade Open WebUI to version 0.9.0 or later, which adds URL validation to the picture-handling path.
- Restrict outbound network access from Open WebUI hosts to only the endpoints required for model providers and OAuth identity providers.
- Limit the set of trusted OAuth identity providers and disable open registration through untrusted providers.
- Block access from the Open WebUI workload to cloud metadata endpoints using IMDSv2 enforcement or host-level firewall rules.
Patch Information
The vulnerability is fixed in Open WebUI 0.9.0. The fix applies validate_url() within _process_picture_url() in backend/open_webui/utils/oauth.py, rejecting requests to disallowed destinations. Refer to the Open WebUI Security Advisory GHSA-24c9-2m8q-qhmh for vendor-published patch details.
Workarounds
- Disable OAuth authentication until the upgrade to 0.9.0 is completed.
- Strip or ignore the picture claim at the reverse proxy or identity provider before it reaches Open WebUI.
- Enforce egress filtering that prevents the Open WebUI process from reaching internal subnets, 127.0.0.0/8, and link-local ranges.
# Example egress restriction using iptables on the Open WebUI host
iptables -A OUTPUT -m owner --uid-owner open-webui -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner open-webui -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner open-webui -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner open-webui -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner open-webui -d 127.0.0.0/8 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
