Executive brief
Open WebUI, a popular interface for interacting with large language models, contains a flaw in how it filters web addresses when fetching external content. An authenticated user can bypass administrator-defined blocklists to make the server fetch data from restricted websites. This could allow users to access and view content from internal or sensitive web services that the organization intended to keep private.
Technical details
A Server-Side Request Forgery (SSRF) protection bypass exists in Open WebUI's `WEB_FETCH_FILTER_LIST` mechanism. The vulnerability stems from the `is_string_allowed` function in `backend/open_webui/utils/misc.py` using `str.endswith()` on full URL strings rather than parsed hostnames. This allows attackers to bypass blocklists by appending a path to the URL (e.g., `internal.com/path` does not end with `internal.com`) or using non-label-boundary matches (e.g., `evilcorp.com` matching a block for `corp.com`). While default protections still block non-global IP ranges (RFC1918), this bypass allows access to publicly-resolvable internal hosts or specific domains restricted by administrators. The issue is fixed in version 0.10.0 by implementing proper DNS label boundary matching on parsed hostnames.
Affected products
- Open WebUI open-webui < 0.10.0
Timeline
- 2026-07-02: disclosed
- 2026-07-09: advisory: NVD publication date
- 2026-07-24: patched: GitHub Advisory published/reviewed