CVE-2026-45347: Open WebUI SSRF Vulnerability

CVE-2026-45347 Overview

CVE-2026-45347 is a blind Server-Side Request Forgery (SSRF) vulnerability in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. The flaw exists in the PDF generation function in versions prior to 0.5.11. User-supplied input is interpreted as HTML and embedded into the generated PDF document. While script tags and certain dangerous elements such as iframe and object are filtered, image tags remain unblocked. An attacker can abuse an <img> tag to force the server to issue outbound HTTP requests to arbitrary destinations. The issue is tracked under [CWE-918] and is fixed in version 0.5.11.

Critical Impact

Authenticated attackers can coerce the Open WebUI server into making outbound HTTP requests to internal network resources, enabling reconnaissance of internal services and potential interaction with cloud metadata endpoints.

Affected Products

• Open WebUI versions prior to 0.5.11
• Self-hosted Open WebUI deployments exposing the PDF export feature
• Open WebUI instances with authenticated user access (PR:L)

Discovery Timeline

• 2026-05-15 - CVE-2026-45347 published to the National Vulnerability Database
• 2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-45347

Vulnerability Analysis

The vulnerability resides in Open WebUI's PDF export pipeline. When a user requests a PDF export, the application takes user-controlled content and renders it as HTML before converting the output to a PDF document. The HTML sanitizer filters dangerous elements including <script>, <iframe>, and <object>, which prevents direct script execution and blocks straightforward content exfiltration through embedded frames.

However, the sanitizer does not strip <img> tags or filter their src attribute. When the PDF rendering engine processes the HTML, it resolves and fetches remote image resources server-side. This behavior allows an authenticated attacker to inject an image element pointing to an internal URL, forcing the server to issue an HTTP request on the attacker's behalf.

Root Cause

The root cause is incomplete input sanitization in the HTML-to-PDF rendering layer. The denylist-based filter blocks several active-content elements but omits passive resource-loading tags. Because the PDF renderer fetches external image references during rendering, any unfiltered src attribute becomes an SSRF primitive [CWE-918].

Attack Vector

An attacker with low-privilege authenticated access submits content containing an <img> tag whose src attribute references an internal endpoint, such as http://127.0.0.1:8080/admin, a cloud metadata service like http://169.254.169.254/latest/meta-data/, or any host on the server's internal network. When the PDF export is triggered, the Open WebUI backend resolves the URL and issues the request from its own network position.

The SSRF is blind: response bodies are not returned to the attacker through the PDF. Attackers can still infer information through timing analysis, side-channel observations, and DNS callbacks. The flaw can be used to enumerate internal services, map network topology, or trigger state-changing requests against unauthenticated internal APIs.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-f776-fp4w-266c for vendor technical details.

Detection Methods for CVE-2026-45347

Indicators of Compromise

• Outbound HTTP requests originating from the Open WebUI server process to internal RFC1918 addresses or 127.0.0.1
• Outbound requests from Open WebUI to cloud metadata endpoints such as 169.254.169.254
• PDF export requests containing HTML payloads with <img> tags referencing internal hostnames or non-standard ports
• Unexpected DNS lookups from the Open WebUI host pointing to attacker-controlled domains

Detection Strategies

• Inspect application logs for PDF export endpoint calls and correlate them with outbound network connections from the server
• Deploy egress filtering rules and alert on connections from the Open WebUI process to internal subnets or link-local addresses
• Apply web application firewall rules that inspect PDF export request bodies for <img> tags referencing private IP ranges or metadata services

Monitoring Recommendations

• Forward Open WebUI access logs and host network telemetry to a centralized SIEM for correlation across the PDF export path
• Baseline normal outbound destinations for the Open WebUI service and alert on first-seen internal endpoints
• Monitor authentication logs for newly created low-privilege accounts that immediately invoke the PDF export endpoint

How to Mitigate CVE-2026-45347

Immediate Actions Required

• Upgrade Open WebUI to version 0.5.11 or later, which removes the SSRF primitive in the PDF generation function
• Restrict the Open WebUI server's egress to only the destinations required for legitimate AI model and integration traffic
• Review user accounts and disable inactive low-privilege accounts that could be leveraged to reach the PDF export feature

Patch Information

The vendor fixed CVE-2026-45347 in Open WebUI version 0.5.11. Patch details and remediation guidance are published in the Open WebUI Security Advisory GHSA-f776-fp4w-266c. Operators should pull the updated container image or upgrade via their existing deployment workflow and verify the running version after restart.

Workarounds

• Block access to the PDF export endpoint at the reverse proxy until the upgrade is complete
• Place Open WebUI behind an egress proxy that denies requests to RFC1918 ranges, 127.0.0.0/8, and 169.254.169.254
• On cloud deployments, enforce IMDSv2 to reduce the impact of metadata service requests reached through SSRF

# Example egress restriction using iptables to block metadata and loopback access
# from the Open WebUI service user (replace UID with the service account UID)
iptables -A OUTPUT -m owner --uid-owner 1000 -d 169.254.169.254 -j DROP
iptables -A OUTPUT -m owner --uid-owner 1000 -d 127.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner 1000 -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner 1000 -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner 1000 -d 192.168.0.0/16 -j DROP