CVE-2026-88001

Analyzed Analyzed - Analysis Complete

Server-Side Request Forgery in Open WebUI

Publication date: 2026-09-09

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEB_FETCH_FILTER_LIST or private-address controls to HTTP redirect destinations when AIOHTTP_CLIENT_ALLOW_REDIRECTS was enabled. An authenticated user could redirect the aiohttp and requests fetch paths to excluded hosts, loopback, private networks, or cloud metadata services and route resulting content into web search, URL ingestion, page-fetch tools, or chat image processing. This issue is fixed in version 0.11.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-14

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-88001

Affected Vendors & Products

Vendor	Product	Version / Range
openwebui	open_webui	From 0.9.5 (inc) to 0.11.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

Open WebUI versions 0.9.5 to 0.11.0 had a flaw where server-side web fetches did not reapply security filters like WEB_FETCH_FILTER_LIST or private-address controls when following HTTP redirects. This allowed authenticated users to bypass restrictions and redirect requests to excluded hosts, loopback addresses, private networks, or cloud metadata services.

Detection Guidance

This vulnerability affects Open WebUI versions between 0.9.5 and 0.11.1. To detect it, check the installed version of Open WebUI by running: docker inspect open-webui | grep Version or cat /path/to/open-webui/version.txt. If the version is between 0.9.5 and 0.11.0, the system is vulnerable.

Impact Analysis

An attacker with access could exfiltrate data to unauthorized destinations, access internal systems, or interact with cloud metadata services. This could lead to data leaks, unauthorized network access, or manipulation of AI tools using web content.

Compliance Impact

This vulnerability could violate data protection requirements by enabling unauthorized data transfers or access to restricted systems. GDPR may require breach notification, while HIPAA could be impacted if protected health information is exposed.

Mitigation Strategies

Upgrade Open WebUI to version 0.11.1 or later to address the vulnerability. Ensure WEB_FETCH_FILTER_LIST and private-address controls are properly enforced on all HTTP redirect destinations.

Hi! I’m here to help you understand CVE-2026-88001. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70