Executive brief
Open WebUI, a user interface for interacting with large language models, is vulnerable to a security flaw that allows attackers to bypass network restrictions. By using a technique called DNS rebinding, an attacker can trick the server into accessing internal company resources, such as private administrative interfaces or cloud metadata services, that should not be reachable from the internet. This could lead to the exposure of sensitive internal data or the theft of cloud service credentials.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Open WebUI due to a Time-of-Check Time-of-Use (TOCTOU) flaw in how user-supplied URLs are validated. The application resolves a hostname to verify it is not a private or loopback address, but then allows the underlying HTTP client to perform a second, unvalidated DNS resolution during the actual connection. An attacker controlling an authoritative DNS server can provide a public IP for the initial check and an internal IP for the subsequent connection. This bypass affects multiple components including the retrieval web loader, chat image fetch, and OAuth profile-picture processing. In cloud environments, this can be used to access the Instance Metadata Service (IMDS) to retrieve IAM credentials. The issue is fixed in version 0.11.0 by enforcing validation at the connection layer.
Affected products
- Open WebUI open-webui <= 0.10.2
Timeline
- 2026-08-02: disclosed
- 2026-08-04: advisory
- 2026-08-04: patched: Fixed in v0.11.0