CVE-2026-54018

High

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the SafePlaywrightURLLoader implements a validate_url function to prevent SSRF attacks by checking the IP address of the user-provided URL. However, this validation is performed only on the initial URL. Since Playwright automatically follows HTTP redirects (301/302) by default, an attacker can bypass the validation by providing a safe URL that redirects to a restricted internal network address (e.g., localhost, Docker container network, or Cloud Metadata). This allows the application to access internal services despite ENABLE_RAG_LOCAL_WEB_FETCH being set to False This vulnerability is fixed in 0.9.6.

SeverityHigh

CVSS7.7

Exploit probability—

ProductOpenwebui Open Webui

PublishedJun 23, 2026

First seenJun 23, 2026

Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Update

openwebui open_webui0.9.6 or later
open-webui0.9.6 or later

Affected products

Product	Affected versions	Fixed in
openwebui open_webui	v < 0.9.6	0.9.6
open-webuiPyPI	v < 0.9.6	0.9.6

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.