CVE-2026-54018: Open WebUI SSRF Vulnerability

CVE-2026-54018 Overview

CVE-2026-54018 is a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI, a self-hosted artificial intelligence platform. The flaw resides in the SafePlaywrightURLLoader component and affects all versions prior to 0.9.6. The validate_url function checks the IP address of the initial user-supplied URL to prevent SSRF, but Playwright follows HTTP 301/302 redirects automatically by default. An attacker can supply a benign-looking URL that redirects to an internal address such as localhost, a Docker network, or cloud metadata endpoints. The bypass succeeds even when ENABLE_RAG_LOCAL_WEB_FETCH is set to False. The issue is tracked under [CWE-918] and is fixed in Open WebUI 0.9.6.

Critical Impact
Authenticated attackers can reach internal services, Docker network resources, and cloud metadata endpoints (e.g., AWS IMDS) through the Open WebUI server, exposing sensitive configuration and credentials.

Affected Products

Open WebUI versions prior to 0.9.6
Deployments using the SafePlaywrightURLLoader for web fetching
Containerized Open WebUI instances with access to internal networks or cloud metadata services

Discovery Timeline

2026-06-23 - CVE-2026-54018 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54018

Vulnerability Analysis

The vulnerability is a classic Time-of-Check Time-of-Use (TOCTOU) flaw expressed through HTTP redirect handling. Open WebUI's SafePlaywrightURLLoader is designed to retrieve external web content for retrieval-augmented generation (RAG) workflows. To prevent SSRF, the loader calls a validate_url function that resolves the supplied hostname and rejects URLs pointing to private, loopback, or link-local IP ranges. The check runs once against the user-supplied URL.

After validation, the URL is passed to Playwright, a headless browser automation framework. Playwright transparently follows HTTP 301 and 302 responses without re-invoking the validation logic. An attacker controls an external HTTP server that returns a redirect to an internal target, and Playwright dutifully fetches that target on behalf of the Open WebUI process. The response body is then returned to the attacker through normal RAG result handling.

Root Cause

The root cause is incomplete URL validation. Security checks are applied only to the first URL in the request chain. The underlying HTTP client follows redirects automatically, and no per-hop validation is performed on intermediate or final destination URLs. The configuration flag ENABLE_RAG_LOCAL_WEB_FETCH=False provides no protection because it is evaluated against the originally submitted hostname, not the redirected destination.

Attack Vector

Exploitation requires network access to Open WebUI and a low-privileged authenticated account. The attacker hosts a controlled URL such as https://attacker.example/redirect. The server responds with HTTP 302 Found and a Location header pointing to an internal resource, for example http://169.254.169.254/latest/meta-data/iam/security-credentials/ for AWS metadata or http://localhost:6379/ for an internal Redis service. Open WebUI passes the initial URL through validation, Playwright follows the redirect, and internal content is rendered and returned to the attacker. See the GitHub Security Advisory GHSA-jrfp-m64g-pcwv for the maintainer's technical write-up.

Detection Methods for CVE-2026-54018

Indicators of Compromise

Outbound HTTP requests from the Open WebUI process to RFC1918 ranges, 127.0.0.0/8, or 169.254.169.254
Application logs showing successful URL validation followed by Playwright fetches to private IPs
Unexpected access entries on internal services (Redis, Elasticsearch, Kubernetes API, cloud IMDS) sourced from the Open WebUI container
External web server logs containing 302 responses to attacker-controlled domains followed shortly by internal resource access

Detection Strategies

Inspect Open WebUI access and RAG fetch logs for URLs whose resolved final destinations differ from the submitted host
Correlate web-fetch user actions with egress proxy logs to identify redirect chains terminating at internal IPs
Deploy egress filtering with alerts on connections from the Open WebUI workload to metadata endpoints or loopback addresses

Monitoring Recommendations

Enable verbose logging on the Playwright loader to record all hops in the redirect chain, not just the initial URL
Forward container network flow logs (VPC Flow Logs, eBPF telemetry) to a centralized analytics platform for SSRF pattern matching
Alert on any process within the Open WebUI namespace attempting to reach 169.254.169.254, metadata.google.internal, or 169.254.170.2

How to Mitigate CVE-2026-54018

Immediate Actions Required

Upgrade Open WebUI to version 0.9.6 or later, which enforces validation across redirect hops
Restrict outbound network access from the Open WebUI container to an allowlist of required external destinations
Block access from the workload to cloud metadata services using IMDSv2 with hop-limit 1 or equivalent controls
Audit recent web-fetch activity for redirect-based SSRF attempts and rotate any credentials exposed via metadata endpoints

Patch Information

The vulnerability is fixed in Open WebUI 0.9.6. The fix is published in the GitHub Security Advisory GHSA-jrfp-m64g-pcwv. The patched SafePlaywrightURLLoader revalidates the destination of each redirect before allowing Playwright to proceed.

Workarounds

Place Open WebUI behind an egress proxy that rejects requests to private, loopback, and link-local address ranges
Run Open WebUI in a network segment with no route to internal services or cloud metadata endpoints
Disable the web-fetch feature entirely if RAG over the public web is not required for your deployment

bash

# Configuration example: upgrade and restrict egress
pip install --upgrade open-webui==0.9.6

# Enforce IMDSv2 with hop limit on AWS to block container metadata SSRF
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1