CVE-2026-59223: Open WebUI WEB_FETCH_FILTER_LIST Bypass (MEDIUM)

Technical summary

The vulnerability exists in the WEB_FETCH_FILTER_LIST matching logic, which compares configured host entries against URL strings without enforcing label-boundary constraints. This allows two distinct bypass vectors: (1) attackers can embed a blocklisted domain as a non-hostname component in the URL path (e.g., a URL containing '!internal.example.com' as path content), and (2) the matching algorithm incorrectly permits sibling domains to match against entries intended to block a specific hostname. The root cause is insufficient validation of domain suffix matching, leading to unintended hostname policy violations. The remediation in 0.10.0 enforces proper label-boundary matching to ensure only legitimate hostname matches are permitted.

Business impact

For organizations using Open WebUI as a self-hosted AI platform, this vulnerability enables authenticated users—whether employees, contractors, or internal accounts—to circumvent network access controls that restrict which external services the AI can reach. In a multi-tenant or shared environment, this could allow users to access sensitive internal APIs, databases, or file servers that should be blocked by policy. The impact is limited to data exposure (confidentiality) and does not enable integrity compromise or denial of service, but the ability to bypass security controls represents a material risk to data segregation and compliance posture.

Affected systems

Open WebUI prior to version 0.10.0 is affected. Organizations running 0.10.0 or later are not vulnerable. The impact is restricted to authenticated users; unauthenticated attackers cannot exploit this flaw due to the PR:L (Privilege: Low) requirement in the CVSS vector.

Exploitability

Exploitation requires valid authentication credentials and can be performed over the network without special conditions or user interaction. An attacker with an Open WebUI account can immediately craft a malicious URL to trigger the bypass. No advanced exploitation techniques are needed, making the barrier to weaponization low. However, real-world impact depends on what restricted URLs the organization intended to block and whether an attacker has legitimate access to an account.

Remediation

Upgrade Open WebUI to version 0.10.0 or later. No workarounds are available for earlier versions; patching is the only remediation. Organizations should verify their deployment version and prioritize updates, particularly in environments where the AI platform can make HTTP requests to sensitive internal services.

Patch guidance

Consult the Open WebUI project releases page to confirm 0.10.0 availability and any interim security advisories. If your deployment is managed through a container registry or package manager, update to the latest 0.10.0 or subsequent release. Test the upgrade in a non-production environment to confirm compatibility with any custom extensions or integrations before rolling out to production. Verify that WEB_FETCH_FILTER_LIST configurations are still in place post-upgrade.

Detection guidance

Monitor Open WebUI access logs and HTTP request patterns for suspicious URL constructions that attempt to access restricted internal hostnames via path manipulation or sibling-domain tricks (e.g., requests containing unexpected domain names in the path component or requests to domains that should be blocked by policy). Audit authenticated user activity and review which external services have been accessed. If available, enable debug logging for the fetch filter logic to observe bypass attempts. A configuration review of WEB_FETCH_FILTER_LIST entries can also reveal whether the organization relies on domain-based access control that may have been circumvented.

Why prioritize this

Although the CVSS score is MEDIUM (4.3), this vulnerability merits prompt patching because it directly undermines a security control—the blocklist mechanism—and affects authenticated but potentially untrusted users. The logic flaw is straightforward to exploit and requires no special privileges beyond a valid account. For organizations where Open WebUI can reach sensitive internal systems, bypassing the fetch filter poses a real threat to data confidentiality. The absence of KEV designation suggests active in-the-wild exploitation has not yet been confirmed, providing a window to patch before widespread abuse.

Risk score, explained

The CVSS:3.1 score of 4.3 reflects a network-accessible vulnerability with low privilege requirement, low attack complexity, and confidentiality impact but no integrity or availability impact. The relatively modest score reflects the authentication prerequisite and the limited scope of exposure (data reading only). However, organizations with stringent controls over which services their AI platform can access should treat this as higher risk in practice, because the vulnerability actively defeats a security boundary.

Frequently asked questions