Executive brief
Open WebUI, an interface for interacting with large language models, is vulnerable to a security flaw that allows logged-in users to bypass network restrictions. By tricking the system into following malicious redirects, an attacker can access internal company services or sensitive configuration data that should not be publicly reachable. This could lead to the exposure of internal systems or unauthorized command execution within the environment.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Open WebUI's web retrieval endpoint (/api/v1/retrieval/process/web). While the application implements a blocklist to prevent direct requests to local or internal IP addresses, it fails to validate the destination of HTTP redirects. An authenticated attacker can provide a URL to a malicious external server that issues a 'Location' redirect header pointing to internal services (e.g., localhost). This bypass allows the attacker to probe internal network services and potentially retrieve instance secrets or execute commands. The issue is addressed in version 0.6.27 by implementing a configurable blocklist that accounts for redirects.
Affected products
- open-webui open-webui < 0.6.27
Timeline
- 2026-06-30: advisory: NVD and VulnCheck published advisory details.
- 2026-05-05: advisory: GitHub Security Advisory GHSA-82r6-c5jm-f3mw published.
- 2026-06-30: patched: Fix committed in version 0.6.27.