Description
Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentially execute commands via instance secrets.
Severity (CVSS)
| Base score | 5.3 |
|---|---|
| Severity | Medium |
| Version | CVSS 4.0 |
| Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N |
| Provided by | CNA |
Weaknesses
- CWE-918 — Server-Side Request Forgery (SSRF)
Affected products
| Vendor | Product | Versions |
|---|---|---|
| open-webui | open-webui | 0 to <0.6.27; 0.6.27 |
References
- https://github.com/open-webui/open-webui/security/advisories/GHSA-82r6-c5jm-f3mw (vendor-advisory)
- https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774 (patch)
- https://www.vulncheck.com/advisories/open-webui-server-side-request-forgery-via-location-redirect-in-api-v1-retrieval-process-web (third-party-advisory)
Generated from the official CVE List on 01 Jul 2026 07:05 UTC.