Securaity Browse advisories
SA-26-060 High

Open WebUI: Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature

Open WebUI

More for Open WebUI RSS feed for Open WebUI

Severity
High, CVSS 8.5
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Record
CVE-2026-45331
Affects
Open WebUI
Known exploited
Not listed in the CISA Known Exploited Vulnerabilities catalog
Published
Record first published by the source
May 15, 2026
Source last modified
June 17, 2026

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, validate_url() in backend/open_webui/retrieval/web/utils.py calls validators.ipv6(ip, private=True), but the validators library does NOT implement the private keyword for IPv6 — the call raises a ValidationError (which is falsy in a boolean context), so every IPv6 address passes the filter. In addition, IPv4-mapped IPv6 (::ffff:10.0.0.1) bypasses the IPv4 check entirely, and several reserved IPv4 ranges (0.0.0.0/8, 100.64.0.0/10, 192.0.0.0/24, etc.) are not blocked. This vulnerability is fixed in 0.9.0.

Description quoted from the NVD record.

Who is affected

Open WebUI is a self-hosted chat interface that lets people use AI language models, and it can run entirely offline. This flaw affects versions before 0.9.0. The problem is in the web search feature, which lets the AI look things up on the web. A safety check is meant to stop that feature from contacting addresses inside your own network, but it fails to block several kinds of network addresses. As a result, someone could get your Open WebUI server to send web requests to private systems that should not be reachable from outside. This flaw is rated High.

What to do

  1. If you are not sure whether your organization uses Open WebUI, ask whoever looks after your computers and servers.
  2. If your organization installed and runs Open WebUI itself, the person who set it up should update it to version 0.9.0 or later, which fixes this flaw.
  3. If an IT provider or vendor runs Open WebUI for your organization, send them this advisory and ask when the update to version 0.9.0 will be done.
  4. After the update, have the person who runs it check that Open WebUI shows version 0.9.0 or later.

Analysis written from the source record as of June 17, 2026 and reviewed before publishing.

Sources

MORE ADVISORIES

See all