Executive brief
Open WebUI is a user-friendly interface for interacting with AI models. The /openai/models endpoint contained a server-side request forgery (SSRF) vulnerability that allowed attackers with low privileges to redirect internal server requests to arbitrary URLs, potentially exposing sensitive data or enabling lateral movement to internal services. This advisory has been withdrawn by the vendor, indicating the vulnerability was determined to be invalid or not reproducible under the stated conditions.
Technical details
The vulnerability was reported as CWE-918 (Server-Side Request Forgery) in the /openai/models endpoint of Open WebUI ≤ 0.3.8. The attack required low privileges and no user interaction; an attacker could manipulate the OpenAI API URL parameter to point to arbitrary internal or external URLs, causing the server to send HTTP requests to that destination and return the response. This could facilitate reconnaissance of internal services, theft of credentials stored as environment variables or secrets, or potential command execution if combined with other weaknesses. The advisory was withdrawn on 2026-09-02, suggesting the reported behavior was either not reproducible, required additional preconditions not initially disclosed, or was disputed by the maintainers. No patched versions have been identified in public sources.
Affected products
- Open WebUI open-webui <= 0.3.8
Timeline
- 2025-03-20: disclosed
- 2025-03-21: advisory: GitHub advisory review
- 2026-09-02: other: Advisory withdrawn - does not describe a valid vulnerability