CVE-2026-56399: Open WebUI SSRF Vulnerability Bypass

CVE-2026-56399 Overview

CVE-2026-56399 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Open WebUI versions prior to 0.6.27. The flaw resides in the /api/v1/retrieval/process/web endpoint, which fetches user-supplied URLs as part of its retrieval-augmented generation (RAG) workflow. Authenticated attackers can bypass the application's SSRF protections by supplying URLs that respond with HTTP redirect (Location) headers pointing to internal resources. Successful exploitation allows requests to reach internal services, cloud metadata endpoints, and other restricted network destinations.

Critical Impact
Authenticated users can pivot through Open WebUI to reach internal services such as cloud instance metadata endpoints (AWS 169.254.169.254, GCP metadata.google.internal, Azure metadata.azure.com), potentially retrieving instance credentials and secrets.

Affected Products

Open WebUI versions prior to 0.6.27
Deployments exposing the /api/v1/retrieval/process/web endpoint
Instances running on cloud providers with accessible metadata services (AWS, GCP, Azure, Alibaba Cloud)

Discovery Timeline

2026-06-30 - CVE-2026-56399 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-56399

Vulnerability Analysis

Open WebUI exposes a retrieval endpoint that fetches remote web content to feed into RAG pipelines. The endpoint applied a filter list intended to block requests to internal addresses, but the check only validated the initial user-supplied URL. When the remote server responded with an HTTP 3xx redirect, the underlying HTTP client followed the Location header without re-applying the SSRF filter. An authenticated attacker hosts a redirector that returns Location: http://169.254.169.254/latest/meta-data/ (or an equivalent internal target), causing the server to issue a request to the restricted destination and return the response body to the caller.

Root Cause

The root cause is inconsistent enforcement of the allow/block list across the HTTP fetch chain. The get_filtered_results logic in backend/open_webui/retrieval/web/main.py filtered domains at the results layer but did not resolve or re-validate hostnames encountered during redirect following. Cloud metadata hostnames and link-local IPs were also absent from the default blocklist prior to the fix.

Attack Vector

The attack requires an authenticated session with permission to call the retrieval endpoint. The attacker submits a URL pointing to a server they control. That server responds with an HTTP redirect to an internal target such as http://169.254.169.254/latest/meta-data/iam/security-credentials/. Open WebUI follows the redirect server-side and returns the fetched content, exposing cloud IAM credentials or internal service data that can be used to escalate access.

python

# Patch: backend/open_webui/config.py
# Adds a default SSRF blocklist for cloud metadata endpoints
DEFAULT_WEB_FETCH_FILTER_LIST = [
    "!169.254.169.254",
    "!fd00:ec2::254",
    "!metadata.google.internal",
    "!metadata.azure.com",
    "!100.100.100.200",
]

web_fetch_filter_list = os.getenv("WEB_FETCH_FILTER_LIST", "")
if web_fetch_filter_list == "":
    web_fetch_filter_list = []
else:
    web_fetch_filter_list = [
        item.strip() for item in web_fetch_filter_list.split(",") if item.strip()
    ]

WEB_FETCH_FILTER_LIST = list(set(DEFAULT_WEB_FETCH_FILTER_LIST + web_fetch_filter_list))

Source: Open WebUI Commit 02238d3

The companion patch in backend/open_webui/retrieval/web/main.py introduces is_string_allowed and resolve_hostname helpers so that redirect targets are resolved to IP addresses and re-checked against the blocklist before the client follows them.

Detection Methods for CVE-2026-56399

Indicators of Compromise

Outbound HTTP requests from the Open WebUI host to link-local addresses such as 169.254.169.254, fd00:ec2::254, or 100.100.100.200.
Server-side fetches to cloud metadata hostnames (metadata.google.internal, metadata.azure.com) originating from the Open WebUI process.
Access log entries on /api/v1/retrieval/process/web containing external URLs immediately followed by internal metadata responses in application logs.
Unexpected use of instance IAM credentials from IP addresses associated with the Open WebUI workload.

Detection Strategies

Alert on any process associated with Open WebUI initiating connections to RFC 1918, link-local, or cloud metadata IP ranges.
Correlate /api/v1/retrieval/process/web request bodies with subsequent egress destinations to identify redirect-driven SSRF chains.
Monitor cloud audit logs (AWS CloudTrail, GCP Audit Logs, Azure Activity Log) for API calls made with instance role credentials shortly after suspicious retrieval requests.

Monitoring Recommendations

Enable IMDSv2 on AWS and require session tokens to prevent credential theft via basic SSRF redirects.
Log all outbound HTTP traffic from the Open WebUI container or host and forward to a centralized SIEM for anomaly detection.
Track authenticated user activity against retrieval endpoints and baseline normal URL patterns to surface abuse.

How to Mitigate CVE-2026-56399

Immediate Actions Required

Upgrade Open WebUI to version 0.6.27 or later, which enforces hostname resolution and blocklist checks across HTTP redirects.
Restrict egress from the Open WebUI workload so it cannot reach cloud metadata endpoints or internal management networks.
Audit authenticated user accounts and rotate any cloud instance credentials that may have been exposed prior to patching.

Patch Information

The fix is delivered in commit 02238d3113e966c353fce18f1b65117380896774, which introduces a default WEB_FETCH_FILTER_LIST blocking link-local and metadata addresses and adds hostname resolution before honoring redirect targets. See the Open WebUI GHSA-82r6-c5jm-f3mw advisory and the VulnCheck SSRF advisory for full details.

Workarounds

Set the WEB_FETCH_FILTER_LIST environment variable to include denies for internal ranges and cloud metadata hostnames when upgrading is not immediately possible.
Place Open WebUI behind an egress proxy that blocks link-local and RFC 1918 destinations regardless of redirect behavior.
Enforce IMDSv2 with hop-limit 1 on AWS to prevent SSRF from reaching instance credentials.
Disable or restrict access to the /api/v1/retrieval/process/web endpoint via reverse proxy rules for untrusted user tiers.

bash

# Configuration example: enforce SSRF blocklist on affected deployments
export WEB_FETCH_FILTER_LIST="!169.254.169.254,!fd00:ec2::254,!metadata.google.internal,!metadata.azure.com,!100.100.100.200,!10.0.0.0/8,!172.16.0.0/12,!192.168.0.0/16"

# AWS: enforce IMDSv2 to require session tokens
aws ec2 modify-instance-metadata-options \
    --instance-id i-0123456789abcdef0 \
    --http-tokens required \
    --http-put-response-hop-limit 1