CVE-2026-54008: Open WebUI SSRF Vulnerability

CVE-2026-54008 Overview

CVE-2026-54008 is a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. The flaw resides in the OAuth profile picture handling logic within backend/open_webui/utils/oauth.py. The _process_picture_url function validates only the initial URL submitted by the user, then issues an HTTP GET request that follows redirects by default. An authenticated attacker with a valid Identity Provider (IdP) account can supply a public URL that returns a 302 redirect to an internal address. The internal response body is then exposed through the attacker's profile_image_url field. The issue is tracked under [CWE-918] and fixed in version 0.9.6.

Critical Impact
An authenticated attacker can read internal network resources by abusing OAuth profile picture fetching to bypass URL validation through HTTP redirects.

Affected Products

Open WebUI versions prior to 0.9.6
Self-hosted Open WebUI deployments with OAuth IdP integration enabled
Instances exposing the OAuth profile picture processing flow

Discovery Timeline

2026-06-23 - CVE-2026-54008 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54008

Vulnerability Analysis

The vulnerability stems from incomplete URL validation in Open WebUI's OAuth login flow. When a user authenticates through an external OAuth provider, the backend retrieves the profile picture referenced by the IdP claim. The _process_picture_url function calls validate_url(picture_url) on the initial URL only. After validation passes, the function invokes aiohttp.ClientSession.get(picture_url, ...) without setting allow_redirects=False. aiohttp defaults to allow_redirects=True with max_redirects=10. The function also fails to apply the project's AIOHTTP_CLIENT_ALLOW_REDIRECTS environment constant. The fetched response body is stored and surfaced through the user's profile_image_url, returning the internal content to the attacker.

Root Cause

The root cause is a time-of-check to time-of-use gap created by HTTP redirect following. Validation occurs on the original URL, but the eventual request target is determined by the remote server's Location header. The mitigation environment constant AIOHTTP_CLIENT_ALLOW_REDIRECTS exists in the project but is not propagated into this code path.

Attack Vector

The attacker registers or controls a valid OAuth IdP identity accepted by the target Open WebUI instance. They configure a publicly reachable URL that responds with HTTP 302 pointing to an internal target such as http://127.0.0.1, http://169.254.169.254/latest/meta-data/, or an internal service endpoint. During OAuth login or profile refresh, the backend follows the redirect, retrieves the internal response, and returns it to the attacker through the profile image field. This enables enumeration of internal services, retrieval of cloud metadata, and exposure of unauthenticated internal HTTP endpoints. See the GitHub Security Advisory GHSA-226f-f24g-524w for vendor details.

Detection Methods for CVE-2026-54008

Indicators of Compromise

Outbound aiohttp requests from the Open WebUI backend resolving to RFC1918, link-local (169.254.0.0/16), or loopback addresses
OAuth user records where profile_image_url content matches internal service responses or cloud metadata payloads
Repeated OAuth sign-ins from the same IdP identity with rotating picture claim hosts
HTTP 302 responses observed in egress logs immediately followed by internal HTTP traffic from the backend host

Detection Strategies

Inspect Open WebUI process egress traffic for connections to internal CIDR ranges originating from the OAuth login workflow
Hunt application logs for _process_picture_url invocations whose final response Content-Type or size deviates from typical image payloads
Correlate OAuth callback events with subsequent outbound HTTP GETs that traverse multiple hosts within the aiohttp default redirect limit of 10

Monitoring Recommendations

Enable egress firewall logging for the Open WebUI backend and alert on requests to 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.169.254
Capture and review stored profile_image_url values for non-image content or HTML responses
Forward Open WebUI application logs into a centralized analytics pipeline to baseline OAuth picture fetch behavior and surface anomalies

How to Mitigate CVE-2026-54008

Immediate Actions Required

Upgrade Open WebUI to version 0.9.6 or later, which contains the official fix
Restrict egress from the Open WebUI backend to only the IdP and image hosts required for operation
Temporarily disable OAuth profile picture ingestion if patching cannot be performed immediately
Review existing user records and purge profile_image_url values that resolved to internal addresses

Patch Information

The vendor released the fix in Open WebUI 0.9.6. The patch disables redirect following on the aiohttp client call within _process_picture_url and honors the AIOHTTP_CLIENT_ALLOW_REDIRECTS configuration. Refer to the GitHub Security Advisory GHSA-226f-f24g-524w for upgrade instructions and commit references.

Workarounds

Set AIOHTTP_CLIENT_ALLOW_REDIRECTS=false in the environment if the deployed version honors it in the affected code path
Place the Open WebUI backend behind an egress proxy that blocks redirects to private IP space
Configure network policies to deny backend access to cloud instance metadata endpoints such as 169.254.169.254

bash

# Configuration example: restrict egress with iptables on the Open WebUI host
iptables -A OUTPUT -m owner --uid-owner openwebui -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openwebui -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openwebui -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openwebui -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openwebui -d 169.254.0.0/16 -j REJECT