Database/AI/ML frameworks & serving
Open WebUI: SSRF via HTTP redirects bypasses private-IP and metadata block list
Impact
Open WebUI checks only the first URL it is given. Its HTTP clients then follow 3xx redirects without checking the new target, so a public URL that redirects to 127.0.0.1, an RFC 1918 address or 169.254.169.254 gets past the block list, and the response body comes back to the user. On a cloud GPU instance this can expose instance-metadata credentials. Anywhere else it exposes internal services the Open WebUI host can reach, such as inference backends, cluster-internal APIs and admin consoles. Several routes are affected: web retrieval, the image endpoints, and chat completions with an image_url part.
Who can reach it
Any authenticated Open WebUI user, over the network, who can host or control a URL that issues a redirect. No admin rights needed.
What to do
Upgrade Open WebUI to 0.9.5 or later and restart the container or service. Until then, apply egress controls to the Open WebUI pod or host: block the cloud metadata address (or require IMDSv2 with a hop limit of 1) and block internal ranges it does not need.
References
Related entries
- NVIDIA OpenShell Sandbox: path traversal bypasses L7 REST network policy, exposing blocked endpointsCVE-2026-65092 · NVIDIA OpenShell Sandbox for Linux (L7 REST network policy enforcement)High
- llama.cpp: integer overflow in new_1batch undersizes the batch allocationCVE-2026-70638 · llama.cpp LLaMA-Android JNI wrapper (new_1batch n_seq_max sizing)High
- Darknet: integer overflow in convolutional layer sizing yields a heap overflow from a crafted .cfgCVE-2026-72852 · hank-ai/darknet convolutional layer (.cfg model definition parsing)High
- vLLM: remote processor code executes even when trust_remote_code is falseCVE-2026-90553 · vLLM (LlavaOnevision2 processor loader)High
- skops (`Card.get_model`): Model card loading has no trusted-types checkCVE-2025-54886 · skops (`Card.get_model`)High
- Jupyter Notebook and JupyterLab: stored XSS in the help command linker steals the session tokenCVE-2026-40171 · Jupyter Notebook / JupyterLab help-extension (command linker sanitizer)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.