Server-Side Request Forgery in Open WebUI by Open WebUI
CVE-2026-45338

7.7HIGH

Key Information:

Vendor

Open-webui

Status
Open-webui
Vendor
CVE Published:
15 May 2026

What is CVE-2026-45338?

A Server-Side Request Forgery (SSRF) vulnerability exists in the Open WebUI platform, specifically in the _process_picture_url() function located in backend/open_webui/utils/oauth.py. This issue allows an attacker to manipulate URL requests sent from the server, enabling potential exposure or exfiltration of internal resources. The vulnerability arises because the function fetches arbitrary URLs from OAuth picture claims without proper validation of the requested URLs. As a result, unauthorized access to internal applications and data could occur, posing significant security risks. This issue has been addressed in version 0.9.0.

Affected Version(s)

open-webui < 0.9.0

References

https://github.com/open-webui/open-webui/security/advisor...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.