Executive brief
Open WebUI is an interface for running artificial intelligence models locally and offline. A security flaw in how the system handles user profile pictures during login allows an attacker to trick the server into accessing internal network resources. This could lead to the theft of sensitive information, such as cloud security credentials or data from other internal databases, which are normally protected from the public internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in `backend/open_webui/utils/oauth.py::_process_picture_url`. While the application performs an initial check on the provided URL using `validate_url()`, it uses the `aiohttp` library to fetch the image with redirects enabled by default and no subsequent validation of the redirect targets. An attacker with a valid OAuth identity can provide a URL that redirects to internal resources (e.g., 127.0.0.1, 169.254.169.254, or RFC1918 addresses). The application then reads the response, base64-encodes it, and stores it in the user's profile image field, allowing the attacker to retrieve the full response body. This is a sibling vulnerability to CVE-2026-45401 and is fixed in version 0.9.6.
Affected products
- Open WebUI Open WebUI < 0.9.6
Timeline
- 2026-06-11: advisory: GitHub Security Advisory GHSA-226f-f24g-524w published
- 2026-06-23: disclosed: CVE-2026-54008 published to NVD
- 2026-06-23: patched: Vulnerability fixed in version 0.9.6