Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 7.7
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Record
- CVE-2026-54018
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 23, 2026
- Source last modified
- July 20, 2026
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the SafePlaywrightURLLoader implements a validate_url function to prevent SSRF attacks by checking the IP address of the user-provided URL. However, this validation is performed only on the initial URL. Since Playwright automatically follows HTTP redirects (301/302) by default, an attacker can bypass the validation by providing a safe URL that redirects to a restricted internal network address (e.g., localhost, Docker container network, or Cloud Metadata). This allows the application to access internal services despite ENABLE_RAG_LOCAL_WEB_FETCH being set to False This vulnerability is fixed in 0.9.6.
Description quoted from the NVD record.
Who is affected
Open WebUI, a self-hosted artificial intelligence chat platform that can run entirely offline, has this flaw in versions before 0.9.6. The problem is in the part that fetches web pages from addresses users provide. It checks only the first address, not where that page sends the request next. Someone can give a harmless-looking address that forwards to a private address, such as the server itself, the internal network linking its containers, or a cloud provider's internal information service. Open WebUI then reaches those internal services even when it is set not to fetch local addresses. This flaw is rated High.
What to do
- If you are not sure whether your organization uses Open WebUI, ask whoever looks after your computers and servers.
- The person who installed or runs Open WebUI for your organization should check which version is in use.
- If the version is earlier than
0.9.6, update Open WebUI to0.9.6or later, which fixes this flaw. - If an IT provider or vendor runs Open WebUI for you, send them this advisory and ask when the update will be done.
- After updating, check that Open WebUI shows version
0.9.6or later, and keep it updated as new releases come out.
Analysis written from the source record as of July 20, 2026 and reviewed before publishing.