Security Flaw in text-generation-webui RAG Extensions by oobabooga

CVE-2026-35486

What is CVE-2026-35486?

A security vulnerability exists in text-generation-webui, specifically within the RAG extensions known as superbooga and superboogav2. Prior to version 4.3, these extensions utilize requests.get() to fetch user-supplied URLs without any form of validation, allowing attackers to access sensitive information. This includes the potential to expose cloud metadata endpoints, steal IAM credentials, and probe internal services, as the fetched content is indiscriminately exfiltrated through the RAG pipeline. Users are advised to upgrade to version 4.3 or later to mitigate these risks.

References