CVE-2026-88001: Server-Side Request Forgery via Redirect Bypass in Open WebUI
Vulnerability ID: CVE-2026-88001
CVSS Score: 5.0
Published: 2026-09-09
Server-Side Request Forgery (SSRF) vulnerability in Open WebUI (v0.9.5 to v0.11.1) allows authenticated users to bypass private IP and host filter lists by abusing HTTP redirect handling or using IP literals with the aiohttp client.
TL;DR
An SSRF vulnerability in Open WebUI allows authenticated attackers to bypass network access controls and fetch internal resources or cloud metadata via crafted redirects and direct IP literals.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-918
- Attack Vector: Network (AV:N)
- CVSS Score: 5.0
- Impact: Low Confidentiality / Information Disclosure
- Exploit Status: Proof of Concept (PoC)
- CISA KEV Status: Not Listed
- Ransomware Use: No Known Association
Affected Systems
- Open WebUI v0.9.5 through v0.11.0 deployments
-
open-webui: >= 0.9.5, < 0.11.1 (Fixed in:
v0.11.1)
Mitigation Strategies
- Upgrade Open WebUI to version v0.11.1 or higher.
- Ensure destination-level filtering is offloaded to the egress gateway when operating behind a forward proxy.
- Disable local web fetching by verifying that ENABLE_LOCAL_WEB_FETCH is set to False.
Remediation Steps:
- Identify current running version of Open WebUI.
- Pull the latest Docker image: docker pull ghcr.io/open-webui/open-webui:main
- Restart the container using the updated image.
- Verify that the version matches v0.11.1 or higher.
- If using an external forward proxy, update its egress access control list to explicitly block private ranges (RFC 1918, RFC 1122, loopback) and metadata IP 169.254.169.254.
Read the full report for CVE-2026-88001 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)