CVE-2026-70480: Open WebUI SSRF Vulnerability

CVE-2026-70480 Overview

CVE-2026-70480 is a client-side Server-Side Request Forgery (SSRF) vulnerability in Open WebUI, a self-hosted AI platform. The flaw affects versions from 0.6.34 up to but not including 0.11.0. Open WebUI renders vega and vega-lite fenced code blocks in chat content by constructing a Vega view in the viewer's browser without a restricted resource loader. An attacker who places a crafted block where another user will view it can force that user's browser to issue attacker-chosen outbound GET requests. Response data from same-origin or CORS-permissive targets can then be read into the rendered visualization. The issue is fixed in version 0.11.0 and is classified under CWE-918.

Critical Impact
A low-privileged chat participant can weaponize Vega specifications to force victim browsers to fetch and expose data from same-origin or CORS-permissive endpoints.

Affected Products

Open WebUI versions 0.6.34 through 0.10.x
Self-hosted Open WebUI deployments rendering user-supplied vega or vega-lite fenced code blocks
Multi-user Open WebUI instances where chat content is visible to other users

Discovery Timeline

2026-08-04 - CVE-2026-70480 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70480

Vulnerability Analysis

Open WebUI supports rendering vega and vega-lite fenced code blocks so that users can display data visualizations inline within chat threads. The renderer constructs a Vega view directly in the viewer's browser using vega.parse and new vega.View. The default Vega loader accepts arbitrary URLs supplied via data.url fields and image mark href attributes.

Because the specification originates from untrusted chat content, an attacker can embed URLs pointing to arbitrary hosts. The victim's browser resolves and fetches those URLs under the victim's session. Responses from same-origin endpoints, such as the Open WebUI backend, or third-party services with permissive CORS headers, are read into the SVG that Vega emits. This turns any chat viewer into an involuntary proxy for attacker-directed requests.

Root Cause

The renderer instantiated vega.View without providing a constrained loader. No restrictions were applied on data.url fetches or on image URIs sanitized by the loader. As a result, the Vega runtime followed any URL declared in the specification, enabling classic SSRF-style behavior executed inside the viewer's browser context.

Attack Vector

An authenticated user with permission to post chat content embeds a vega or vega-lite code block referencing an internal or CORS-permissive URL. When another user views the message, their browser fetches the target URL and Vega incorporates the response into the rendered chart. This allows targeted reconnaissance of internal services reachable from the victim's browser and exfiltration of readable response content back into the DOM.

typescript

		const vegaLite = await import('vega-lite');
		vegaSpec = vegaLite.compile(parsedSpec).spec;
	}
-	const view = new vega.View(vega.parse(vegaSpec), { renderer: 'none' });
+	// Specs come from untrusted chat content: block external loads via data.url (loader.load)
+	// and image mark hrefs emitted into the SVG (loader.sanitize).
+	const loader = vega.loader();
+	loader.load = async () => {
+		throw new Error('External resource loading is disabled for rendered visualizations');
+	};
+	const sanitize = loader.sanitize.bind(loader);
+	loader.sanitize = async (uri: string, options: any) => {
+		// Resolve with the browser's URL parser so encoding tricks match what it would fetch
+		const resolved = new URL(uri, document.baseURI);
+		if (resolved.protocol !== 'data:' && resolved.origin !== location.origin) {
+			throw new Error('External resource loading is disabled for rendered visualizations');
+		}
+		return sanitize(uri, options);
+	};
	const view = new vega.View(vega.parse(vegaSpec), { loader, renderer: 'none' });
	const svg = await view.toSVG();
	return svg;
};

Source: GitHub commit 5278eb9. The patch replaces the default loader with one that throws on any external load call and only permits data: URIs or same-origin fetches after URL parsing.

Detection Methods for CVE-2026-70480

Indicators of Compromise

Chat messages containing fenced code blocks tagged vega or vega-lite with data.url fields referencing external hosts or internal IP ranges
Vega specifications containing image marks whose href values point to attacker-controlled or internal endpoints
Unexpected outbound GET requests from user browsers to internal services shortly after loading Open WebUI chats

Detection Strategies

Inspect chat message payloads server-side for vega or vega-lite code blocks and flag any url or href values that are not same-origin or data: URIs
Correlate browser-originated requests to internal endpoints with active Open WebUI sessions in web proxy or reverse proxy logs
Review Content Security Policy (CSP) violation reports for connect-src or img-src blocks originating from the Open WebUI application

Monitoring Recommendations

Log and alert on Open WebUI backend requests where the Referer header matches the chat rendering path and the destination is unusual
Track version strings of deployed Open WebUI instances and alert when releases prior to 0.11.0 remain in production
Monitor egress traffic from user workstations to sensitive internal ranges while Open WebUI is in use

How to Mitigate CVE-2026-70480

Immediate Actions Required

Upgrade all Open WebUI instances to version 0.11.0 or later, which ships the constrained Vega loader
Restrict chat-posting privileges to trusted users on multi-tenant deployments until the upgrade is complete
Apply a strict Content Security Policy limiting connect-src and img-src to same-origin and required data sources

Patch Information

The fix is available in Open WebUI v0.11.0. Technical remediation details are documented in GHSA-rffm-9q57-q649 and implemented via Pull Request #26806. The patch overrides the Vega loader.load function to reject all external loads and augments loader.sanitize to permit only data: URIs or URLs resolving to the current origin.

Workarounds

Disable rendering of vega and vega-lite fenced code blocks by removing or gating the corresponding renderer in src/lib/utils/index.ts until upgrade
Deploy a network policy that blocks browser-originated requests from Open WebUI users to sensitive internal ranges
Enforce a Content Security Policy that whitelists only necessary origins for connect-src, img-src, and default-src

bash

# Upgrade Open WebUI to the fixed release
docker pull ghcr.io/open-webui/open-webui:0.11.0
docker stop open-webui && docker rm open-webui
docker run -d -p 3000:8080 \
  -v open-webui:/app/backend/data \
  --name open-webui \
  --restart always \
  ghcr.io/open-webui/open-webui:0.11.0

# Example strict CSP header applied at the reverse proxy
add_header Content-Security-Policy "default-src 'self'; img-src 'self' data:; connect-src 'self';";