CVE-2026-54018: Open WebUI SSRF Bypass via HTTP Redirect Chain (0.9.6 Patch)

Technical summary

The SafePlaywrightURLLoader in Open WebUI implements a validate_url function intended to prevent SSRF attacks by inspecting the IP address of user-supplied URLs. However, validation occurs only on the initial request URL, not on redirected destinations. Because Playwright follows HTTP 301/302 redirects automatically, an attacker can chain a redirect from an approved external URL to a restricted internal address (localhost, private IP ranges, Docker networks, cloud metadata services). This permits unauthorized access to internal services even when ENABLE_RAG_LOCAL_WEB_FETCH is disabled. The root cause is incomplete redirect chain validation.

Business impact

This vulnerability enables authenticated attackers to access internal services and resources that should be isolated from external or untrusted network access. In environments where Open WebUI is deployed with RAG (Retrieval-Augmented Generation) features, attackers could extract sensitive data from internal services, cloud metadata endpoints, or administrative interfaces. The requirement for authentication limits blast radius but does not eliminate risk, especially in organizations where user accounts have loose access controls. Organizations relying on ENABLE_RAG_LOCAL_WEB_FETCH=False for security posture should consider this control bypassed until patched.

Affected systems

Open WebUI versions prior to 0.9.6 are affected. The vulnerability requires the SafePlaywrightURLLoader to be in use and typically impacts deployments leveraging the RAG (Retrieval-Augmented Generation) or web-fetch functionality. Self-hosted instances are affected; SaaS deployments depend on vendor patch status. Authenticated users are required to trigger the attack, meaning internal users, federated accounts, or accounts compromised through other means pose risk.

Exploitability

Exploitability is straightforward for authenticated users. No special tools or advanced techniques are required—the attacker simply provides a redirect chain (external URL → internal destination) through standard Open WebUI interfaces. Publicly available redirector services or attacker-controlled domains can be used to craft the redirect. The attack requires network-level access to the Open WebUI instance (authenticated session) but is otherwise low-complexity. Detection by defensive measures is minimal if redirect chains are not explicitly logged or monitored.

Remediation

Upgrade to Open WebUI version 0.9.6 or later, which fixes the validation logic to inspect final destination URLs after redirects. Organizations should verify their current version and plan upgrade timing accordingly. In the interim, network segmentation isolating Open WebUI from sensitive internal services provides defense-in-depth; disable ENABLE_RAG_LOCAL_WEB_FETCH if the feature is not actively required. Review authentication and access controls to limit which user accounts can interact with RAG/web-fetch functionality.

Patch guidance

Apply Open WebUI version 0.9.6 or any subsequent release. Verify the patch by checking the version string in application settings or through the package manager used for deployment. If using containerized deployment, pull the updated image and redeploy. Test the patched version in a non-production environment first to ensure RAG and web-fetch functionality operate as expected. No data migration or configuration changes are required.

Detection guidance

Monitor application logs for HTTP redirect chains, especially redirects from external domains to private IP ranges (127.0.0.1, 10.x.x.x, 172.16-31.x.x, 192.168.x.x) or cloud metadata endpoints (169.254.169.254). Audit authentication logs for unusual session activity preceding web-fetch requests. Deploy network detection rules triggering on outbound connections from Open WebUI to localhost or RFC1918 ranges if such connectivity is unexpected. Inspect HTTP request/response headers for Location headers pointing to internal addresses. WAF or proxy rules can flag requests with redirect payloads targeting internal networks.

Why prioritize this

This vulnerability scores CVSS 7.7 (HIGH) due to high confidentiality impact coupled with low complexity and no special privileges required beyond authentication. While the attack requires an authenticated user, the ability to bypass a critical security control and access internal resources represents significant risk in multi-tenant or high-security environments. The vulnerability directly undermines the intended isolation of internal services and should be prioritized for patching within 30 days, sooner if sensitive internal services are exposed on the same network.

Risk score, explained

CVSS 3.1 score of 7.7 (HIGH) reflects: (1) Network-adjacent attack vector requiring only valid authentication; (2) Low attack complexity—standard HTTP redirect mechanism; (3) Limited privileges needed—authenticated users can trigger; (4) High confidentiality impact due to potential access to internal secrets, metadata, or administrative interfaces; (5) Changed scope—the vulnerability allows escaping the intended isolation boundary; (6) No integrity or availability impact in the typical attack scenario. The score appropriately captures the risk of internal data exposure while acknowledging the authentication prerequisite.

Frequently asked questions