CVE-2026-88001: Open WebUI SSRF Vulnerability

CVE-2026-88001 Overview

CVE-2026-88001 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Open WebUI, an extensible self-hosted AI platform. The flaw affects versions 0.9.5 through 0.11.0 and stems from server-side web fetches failing to reapply WEB_FETCH_FILTER_LIST or private-address controls to HTTP redirect destinations when AIOHTTP_CLIENT_ALLOW_REDIRECTS is enabled. An authenticated user can redirect the aiohttp and requests fetch paths to excluded hosts, loopback interfaces, private networks, or cloud metadata services. The fetched content flows into web search, URL ingestion, page-fetch tools, or chat image processing. Version 0.11.1 remediates the issue.

Critical Impact
Authenticated attackers can pivot server-side HTTP fetches to internal hosts and cloud metadata endpoints (for example, 169.254.169.254), enabling reconnaissance of private networks and disclosure of instance credentials.

Affected Products

Open WebUI versions 0.9.5 through 0.11.0
Deployments with AIOHTTP_CLIENT_ALLOW_REDIRECTS enabled
Instances exposing web search, URL ingestion, page-fetch tools, or chat image processing

Discovery Timeline

2026-09-09 - CVE-2026-88001 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-88001

Vulnerability Analysis

Open WebUI's server-side fetch pipeline enforces host allow/block controls at the initial request URL, but the controls do not re-run on redirect targets. When AIOHTTP_CLIENT_ALLOW_REDIRECTS is set, both the aiohttp and requests code paths follow HTTP 3xx responses to any host the redirect specifies. An authenticated user submits a URL pointing to an attacker-controlled server that returns a redirect to an internal destination. The Open WebUI backend then fetches that destination and passes the response into downstream consumers such as retrieval augmented generation (RAG) web fetch, URL ingestion, or chat image processing.

The outcome is classic Server-Side Request Forgery. Attackers reach cloud instance metadata services, loopback-bound admin panels, and internal HTTP APIs from the trusted server context. Because responses feed the LLM pipeline, retrieved data can be exfiltrated through chat output.

Root Cause

The filter that enforces WEB_FETCH_FILTER_LIST and private-address rules only evaluated the initial request URL. Redirect targets bypassed both the deny list and the resolved-IP checks. The patch consolidates address checks onto the request path so every hop, including redirect destinations, is validated.

Attack Vector

Exploitation requires an authenticated Open WebUI account and network reachability to the server. The attacker hosts a public endpoint returning a redirect to a sensitive internal URL, then triggers any Open WebUI feature that performs server-side fetching against the attacker URL.

python

# Security patch in backend/open_webui/config.py
# Consolidated web fetch address checks onto the request path (#27823)

ENABLE_RAG_LOCAL_WEB_FETCH = ENABLE_LOCAL_WEB_FETCH


# Operators extend this through WEB_FETCH_FILTER_LIST.
DEFAULT_WEB_FETCH_FILTER_LIST = [
    '!169.254.169.254',
    '!fd00:ec2::254',
    '!metadata.google.internal',
    '!metadata.azure.com',
    '!100.100.100.200',
    '!168.63.129.16',  # Azure platform channel, reachable from every Azure VM
    '!192.88.99.0/24',  # 6to4 relay anycast, deprecated by RFC 7526
    '!224.0.0.0/4',  # IPv4 multicast
    '!::ffff:0:0:0/96',  # IPv4-translated (SIIT, RFC 2765)
    '!64:ff9b:1::/48',  # NAT64 local-use prefix, RFC 8215
    '!100:0:0:1::/64',  # dummy prefix, RFC 9780
    '!2001:1::1',  # PCP anycast, RFC 7723
    '!2001:1::2',  # TURN anycast, RFC 8155
    '!2001:20::/28',  # ORCHIDv2, RFC 7343
    '!2001:30::/28',  # DRIP, RFC 9374
    '!5f00::/16',  # SRv6 SIDs, RFC 9602
    '!fec0::/10',  # IPv6 site-local, deprecated by RFC 3879
    '!ff00::/8',  # IPv6 multicast
]

Source: GitHub Commit e3e4bd8

Detection Methods for CVE-2026-88001

Indicators of Compromise

Outbound HTTP requests from the Open WebUI backend to link-local metadata addresses such as 169.254.169.254, fd00:ec2::254, metadata.google.internal, metadata.azure.com, or 168.63.129.16.
Backend fetches resolving to loopback (127.0.0.0/8, ::1) or RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
Access log entries where a user-submitted URL returns a 3xx followed by a request to an internal host.

Detection Strategies

Correlate authenticated Open WebUI user activity with egress network flows from the application host to internal or metadata endpoints.
Alert on any application-layer request from Open WebUI to cloud metadata service IPs regardless of protocol.
Inspect chat and RAG output for content patterns matching IAM tokens, instance identity documents, or .internal DNS suffixes.

Monitoring Recommendations

Enable verbose logging on the Open WebUI fetch pipeline and forward logs to a central analytics platform for correlation.
Monitor outbound DNS resolutions from the Open WebUI host for private-range answers.
Track version banners of deployed Open WebUI instances to identify hosts still running versions between 0.9.5 and 0.11.0.

How to Mitigate CVE-2026-88001

Immediate Actions Required

Upgrade Open WebUI to version 0.11.1 or later, which reapplies address filters to redirect destinations.
Rotate any cloud instance credentials, IAM role tokens, or API keys reachable from the Open WebUI host if metadata access cannot be ruled out.
Audit Open WebUI access logs and network egress from the deployment host for indicators of internal fetches.

Patch Information

The fix is delivered in Open WebUI Release v0.11.1 via Pull Request #27823 and commit e3e4bd8. The patch consolidates address checks so WEB_FETCH_FILTER_LIST and private-address controls apply to every hop, including redirect targets. See the GHSA-5x7x-4c3c-qf5w advisory for full details.

Workarounds

Disable HTTP redirects on server-side fetches by setting AIOHTTP_CLIENT_ALLOW_REDIRECTS=false until patched.
Block egress from the Open WebUI host to cloud metadata IPs, loopback, and RFC1918 ranges at the network layer.
Restrict Open WebUI access to trusted users only and disable web search, URL ingestion, and page-fetch tools if not required.

bash

# Configuration example: disable redirect following and harden egress
export AIOHTTP_CLIENT_ALLOW_REDIRECTS=false

# Extend the fetch filter list with additional internal ranges
export WEB_FETCH_FILTER_LIST="!169.254.169.254,!metadata.google.internal,!metadata.azure.com,!10.0.0.0/8,!172.16.0.0/12,!192.168.0.0/16,!127.0.0.0/8"

# Optional: block metadata endpoints at the host firewall (Linux/iptables)
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 168.63.129.16 -j REJECT