CVE-2026-88001

Open WebUI versions 0.9.5 through 0.11.0 fail to re-apply WEB_FETCH_FILTER_LIST and private-address protections to HTTP redirect destinations when AIOHTTP_CLIENT_ALLOW_REDIRECTS is enabled (CWE-918, server-side request forgery). An authenticated user can supply a URL that redirects to an otherwise-blocked target, causing the aiohttp and requests fetch paths to follow the redirect to loopback, internal/private networks, or cloud metadata services such as 169.254.169.254. The fetched content can then be surfaced through web search results, URL ingestion, page-fetch tools, or chat image processing, giving the attacker read access to internal services and potentially cloud credentials. Self-hosted Open WebUI deployments that enable automatic redirects and expose fetch features to regular users are affected. The flaw is fixed in version 0.11.1; a public advisory with technical details exists, but there is no evidence of in-the-wild exploitation and EPSS is low (0.3%, 19th percentile).

What to do: Upgrade Open WebUI to 0.11.1 or later, which re-applies filter-list and private-address checks to redirect destinations. If immediate upgrade is not possible, disable AIOHTTP_CLIENT_ALLOW_REDIRECTS so redirects are not automatically followed, and verify WEB_FETCH_FILTER_LIST excludes loopback, RFC1918 ranges, and 169.254.169.254. Review fetch and access logs for redirects targeting internal IPs or the metadata endpoint, restrict egress from the Open WebUI container/host, and rotate any cloud credentials if metadata fetches are observed.