CVE-2026-54008: Open WebUI SSRF via redirect bypass in OAuth profile picture processing

CVE-2026-54008 · Severity: high · CVSS 8.5 · Published 2026-06-23

Open WebUI is an interface for running artificial intelligence models locally and offline. A security flaw in how the system handles user profile pictures during login allows an attacker to trick the server into accessing internal network resources. This could lead to the theft of sensitive information, such as cloud security credentials or data from other internal databases, which are normally protected from the public internet.

Technologies: open-webui (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54008 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54008 being exploited in the wild.
How severe is CVE-2026-54008?
High severity, with a CVSS score of 8.5, published 23 June 2026.
Which products and versions are affected?
open-webui (PyPI) <= 0.9.5, ECOSYSTEM:introduced=0,fixed=0.9.6.
Is there a fix for CVE-2026-54008?
Yes. open-webui (PyPI): upgrade to 0.9.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54008 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54008?
Check whether you run open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • open-webui (PyPI): upgrade to 0.9.6 or later
    pip install "open-webui>=0.9.6"

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in `backend/open_webui/utils/oauth.py::_process_picture_url`. While the application performs an initial check on the provided URL using `validate_url()`, it uses the `aiohttp` library to fetch the image with redirects enabled by default and no subsequent validation of the redirect targets. An attacker with a valid OAuth identity can provide a URL that redirects to internal resources (e.g., 127.0.0.1, 169.254.169.254, or RFC1918 addresses). The application then reads the response, base64-encodes it, and stores it in the user's profile image field, allowing the attacker to retrieve the full response body. This is a sibling vulnerability to CVE-2026-45401 and is fixed in version 0.9.6.

Affected products

  • Open WebUI Open WebUI < 0.9.6

Identifiers

  • CVE-2026-54008
  • GHSA-226f-f24g-524w
  • PYSEC-2026-2690

Timeline

  • 2026-06-11: advisory: GitHub Security Advisory GHSA-226f-f24g-524w published
  • 2026-06-23: disclosed: CVE-2026-54008 published to NVD
  • 2026-06-23: patched: Vulnerability fixed in version 0.9.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.