CVE-2026-88001

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-88001
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88001.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-88001
Aliases
Published
2026-09-09T21:38:05Z
Modified
2026-09-12T03:30:40Z
Severity
  • 5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVSS Calculator
Summary
Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets
Details

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEB_FETCH_FILTER_LIST or private-address controls to HTTP redirect destinations when AIOHTTP_CLIENT_ALLOW_REDIRECTS was enabled. An authenticated user could redirect the aiohttp and requests fetch paths to excluded hosts, loopback, private networks, or cloud metadata services and route resulting content into web search, URL ingestion, page-fetch tools, or chat image processing. This issue is fixed in version 0.11.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88001.json"
}
References

Affected packages

Git / github.com/open-webui/open-webui

Affected ranges

Type
GIT
Repo
https://github.com/open-webui/open-webui
Events
Introduced
3660bc00fd807deced3400a63bfa6db47811a3bb
Fixed
e3e4bd87df6fc629e7e22081d980d55a7632b8b7
Fixed
d3e8bf3405e848cfba377814d0aa7ba7290e414d
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.9.5"
        },
        {
            "fixed": "0.11.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.10.0
v0.10.1
v0.10.2
v0.11.0
v0.9.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88001.json"