# CVE-2026-88001: Open WebUI server-side request forgery via unvalidated HTTP redirects

Source: https://junglewise.ai/threats/cve-2026-88001-open-webui-server-side-request-forgery-via-unvalidated-http  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-88001 · Severity: medium · CVSS 5 · Published 2026-09-09

Open WebUI is a web interface for interacting with large language models and fetching external content. The application failed to apply its security filters to HTTP redirect destinations, allowing authenticated users to bypass access controls and reach internal addresses, private networks, and cloud metadata endpoints that the administrator intended to block.

Technologies: [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-88001 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88001 being exploited in the wild.

**How severe is CVE-2026-88001?** Medium severity, with a CVSS score of 5, published 9 September 2026.

**Which products and versions are affected?** open-webui (PyPI) >= 0.9.5, <= 0.11.0, ECOSYSTEM:introduced=0.9.5,fixed=0.11.1.

**Is there a fix for CVE-2026-88001?** Yes. open-webui (PyPI): upgrade to 0.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-88001 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-88001?** Check whether you run open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- open-webui (PyPI): upgrade to 0.11.1 or later

  ```sh
  pip install "open-webui>=0.11.1"
  ```


## Technical details

This is a server-side request forgery (SSRF) vulnerability in Open WebUI's URL fetching logic. The vulnerability affects the aiohttp and requests HTTP clients used for web retrieval, the built-in page fetch tool, and URL ingestion endpoints. The root cause is that two security controls—an excluded-host list and a private-address check—were only applied to the user-submitted URL, not to redirect destinations. When AIOHTTP_CLIENT_ALLOW_REDIRECTS is set to true (default is false), an authenticated user with any role can submit a URL that returns an HTTP redirect to a blocked host, internal IP address, or cloud metadata endpoint (e.g., 169.254.169.254). The server follows the redirect without re-evaluating either control, reaching hosts the administrator explicitly excluded and private network addresses including loopback and cloud metadata services. Patched in version 0.11.1, which now evaluates both controls against the final redirect destination before making the connection.

## Affected products

- open-webui open-webui >= 0.9.5, <= 0.11.0

## Identifiers

- CVE-2026-88001
- GHSA-5x7x-4c3c-qf5w
- PYSEC-2026-3878

## Timeline

- 2026-08-29: disclosed
- 2026-09-09: advisory
- 2026-09-09: patched: Fixed in version 0.11.1

## References

- [https://api.github.com/users/arpitjain099](https://api.github.com/users/arpitjain099)
- [https://github.com/arpitjain099](https://github.com/arpitjain099)
- [https://api.github.com/users/arpitjain099/gists%7B/gist_id%7D](https://api.github.com/users/arpitjain099/gists%7B/gist_id%7D)
- [https://api.github.com/users/arpitjain099/repos](https://api.github.com/users/arpitjain099/repos)
- [https://avatars.githubusercontent.com/u/3242828?v=4](https://avatars.githubusercontent.com/u/3242828?v=4)
- [https://api.github.com/users/arpitjain099/events%7B/privacy%7D](https://api.github.com/users/arpitjain099/events%7B/privacy%7D)

## Related threats

- [Open WebUI OAuth token exchange authorization bypass](https://junglewise.ai/threats/cve-2026-88006-open-webui-oauth-token-exchange-authorization-bypass)
- [Open WebUI OAuth token exchange authorization bypass](https://junglewise.ai/threats/cve-2026-88005-open-webui-oauth-token-exchange-authorization-bypass)
- [Open WebUI infinite loop denial of service in chat history reconstruction](https://junglewise.ai/threats/cve-2026-88002-open-webui-infinite-loop-denial-of-service-in-chat-history)
- [Open WebUI denial of service via cyclic chat tree message deletion](https://junglewise.ai/threats/cve-2026-88000-open-webui-denial-of-service-via-cyclic-chat-tree-message)
- [Open WebUI server-side request forgery in URL fetching](https://junglewise.ai/threats/cve-2026-87999-open-webui-server-side-request-forgery-in-url-fetching)