CVE-2026-54018 Details
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the SafePlaywrightURLLoader implements a validate_url function to prevent SSRF attacks by checking the IP address of the user-provided URL. However, this validation is performed only on the initial URL. Since Playwright automatically follows HTTP redirects (301/302) by default, an attacker can bypass the validation by providing a safe URL that redirects to a restricted internal network address (e.g., localhost, Docker container network, or Cloud Metadata). This allows the application to access internal services despite ENABLE_RAG_LOCAL_WEB_FETCH being set to False This vulnerability is fixed in 0.9.6.
A server-side request forgery (SSRF) vulnerability has been identified in Open WebUI versions prior to 0.9.6. The issue arises in the SafePlaywrightURLLoader, where the validate_url function, intended to prevent SSRF attacks by checking the IP address of user-provided URLs, only validates the initial URL. Playwright's default behavior of following HTTP redirects allows an attacker to bypass this validation by using a safe URL that redirects to a restricted internal network address, such as localhost or Docker container networks. This exploitation enables access to internal services, even with the 'ENABLE_RAG_LOCAL_WEB_FETCH' setting turned off.
Users can update to Open WebUI version 0.9.6 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open-webui/open-webui/security/advisories/GHSA-jrfp-m64g-pcwv | CISA-ADP | ExploitVendor AdvisoryMitigation |
| https://github.com/open-webui/open-webui/security/advisories/GHSA-jrfp-m64g-pcwv | [email protected] | ExploitVendor AdvisoryMitigation |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openwebui open webui | < 0.9.6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | New CVE Received | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |