Executive brief
Open WebUI, an interface for interacting with large language models, is vulnerable to a security flaw that allows authenticated users to access internal network services. By using specially formatted web addresses, an attacker can bypass security filters to view sensitive information from the server's internal environment, such as cloud configuration data or private administrative interfaces. This could lead to the exposure of internal credentials or unauthorized access to other systems within the same corporate network.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Open WebUI's URL validation logic within `backend/open_webui/retrieval/web/utils.py`. The application uses `ipaddress.ip_address(ip).is_global` to determine if a destination is safe to fetch, but this check fails to account for IPv4 addresses embedded in IPv6 transition encodings like NAT64 (64:ff9b::/96). An authenticated attacker can provide a NAT64-prefixed URL that points to internal IPv4 resources (e.g., 127.0.0.1 or cloud metadata services at 169.254.169.254). If the deployment network supports NAT64 translation, the request will be routed to the internal target, and the response body will be returned to the attacker. This issue is fixed in version 0.11.0 by properly unwrapping transition encodings before validation.
Affected products
- Open WebUI open-webui >= 0.9.0, < 0.11.0
Timeline
- 2026-08-02: patched: Fixed in v0.11.0 via commit 1717b493d83c86afa82aa8bc50139250852dd2f3
- 2026-08-04: advisory: GitHub Advisory GHSA-8x5v-cpv7-8jjp published