Executive brief
Open WebUI is a web interface for interacting with large language models and fetching external content. The application failed to apply its security filters to HTTP redirect destinations, allowing authenticated users to bypass access controls and reach internal addresses, private networks, and cloud metadata endpoints that the administrator intended to block.
Technical details
This is a server-side request forgery (SSRF) vulnerability in Open WebUI's URL fetching logic. The vulnerability affects the aiohttp and requests HTTP clients used for web retrieval, the built-in page fetch tool, and URL ingestion endpoints. The root cause is that two security controls—an excluded-host list and a private-address check—were only applied to the user-submitted URL, not to redirect destinations. When AIOHTTP_CLIENT_ALLOW_REDIRECTS is set to true (default is false), an authenticated user with any role can submit a URL that returns an HTTP redirect to a blocked host, internal IP address, or cloud metadata endpoint (e.g., 169.254.169.254). The server follows the redirect without re-evaluating either control, reaching hosts the administrator explicitly excluded and private network addresses including loopback and cloud metadata services. Patched in version 0.11.1, which now evaluates both controls against the final redirect destination before making the connection.
Affected products
- open-webui open-webui >= 0.9.5, <= 0.11.0
Timeline
- 2026-08-29: disclosed
- 2026-09-09: advisory
- 2026-09-09: patched: Fixed in version 0.11.1