https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 15:29:52 +0000 https://db.gcve.eu/vuln/bdu:2026-14816 bdu:2026-14816 https://db.gcve.eu/vuln/bdu:2026-14816 https://db.gcve.eu/vuln/fkie_cve-2026-88001 <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEB_FETCH_FILTER_LIST or private-address controls to HTTP redirect destinations when AIOHTTP_CLIENT_ALLOW_REDIRECTS was enabled. An authenticated user could redirect the aiohttp and requests fetch paths to excluded hosts, loopback, private networks, or cloud metadata services and route resulting content into web search, URL ingestion, page-fetch tools, or chat image processing. This issue is fixed in version 0.11.1.</p> <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEB_FETCH_FILTER_LIST or private-address controls to HTTP redirect destinations when AIOHTTP_CLIENT_ALLOW_REDIRECTS was enabled. An authenticated user could redirect the aiohttp and requests fetch paths to excluded hosts, loopback, private networks, or cloud metadata services and route resulting content into web search, URL ingestion, page-fetch tools, or chat image processing. This issue is fixed in version 0.11.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-88001 https://db.gcve.eu/vuln/ghsa-5x7x-4c3c-qf5w <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>Open WebUI protects server-side web fetches with two controls: the operator&#39;s list of excluded hosts, and a check that refuses private and internal addresses. Neither control was applied to the destination of an HTTP redirect. On a deployment where redirect following is enabled, any authenticated user who can cause the server to fetch a URL could submit a page that redirects, and the server would fetch the redirect destination without either control being applied to it. The server therefore connects to hosts the operator excluded, and to internal addresses including loopback, private networks and cloud metadata endpoints.</p> <p>## Preconditions</p> <p>`AIOHTTP_CLIENT_ALLOW_REDIRECTS` must be set to `true`. Its default is `false`, and on the default the affected fetch paths do not follow redirects at all, so a deployment that has not changed this setting is not affected.</p> <p>The attacker needs an authenticated account of any role, with access to any feature that causes the server to fetch a URL. Web search, ingesting a URL into a collection, the built-in page fetch tool and image URLs in chat all reach it. No internal hostnames need to be known, because the loopback and cloud metadata addresses are fixed and identical on every deployment.</p> <p>Neither `ENABLE_LOCAL_WEB_FETCH` at its default of `false` nor any set of entries in `WEB_FETCH_FILTER_LIST` prevents this.</p> <p>## Impact</p> <p>An authenticated user can make the server issue requests to hosts the operator deliberately excluded, and…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>Open WebUI protects server-side web fetches with two controls: the operator&#39;s list of excluded hosts, and a check that refuses private and internal addresses. Neither control was applied to the destination of an HTTP redirect. On a deployment where redirect following is enabled, any authenticated user who can cause the server to fetch a URL could submit a page that redirects, and the server would fetch the redirect destination without either control being applied to it. The server therefore connects to hosts the operator excluded, and to internal addresses including loopback, private networks and cloud metadata endpoints.</p> <p>## Preconditions</p> <p>`AIOHTTP_CLIENT_ALLOW_REDIRECTS` must be set to `true`. Its default is `false`, and on the default the affected fetch paths do not follow redirects at all, so a deployment that has not changed this setting is not affected.</p> <p>The attacker needs an authenticated account of any role, with access to any feature that causes the server to fetch a URL. Web search, ingesting a URL into a collection, the built-in page fetch tool and image URLs in chat all reach it. No internal hostnames need to be known, because the loopback and cloud metadata addresses are fixed and identical on every deployment.</p> <p>Neither `ENABLE_LOCAL_WEB_FETCH` at its default of `false` nor any set of entries in `WEB_FETCH_FILTER_LIST` prevents this.</p> <p>## Impact</p> <p>An authenticated user can make the server issue requests to hosts the operator deliberately excluded, and…</p> https://db.gcve.eu/vuln/ghsa-5x7x-4c3c-qf5w https://db.gcve.eu/vuln/pysec-2026-3878 <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>Open WebUI protects server-side web fetches with two controls: the operator&#39;s list of excluded hosts, and a check that refuses private and internal addresses. Neither control was applied to the destination of an HTTP redirect. On a deployment where redirect following is enabled, any authenticated user who can cause the server to fetch a URL could submit a page that redirects, and the server would fetch the redirect destination without either control being applied to it. The server therefore connects to hosts the operator excluded, and to internal addresses including loopback, private networks and cloud metadata endpoints.</p> <p>## Preconditions</p> <p>`AIOHTTP_CLIENT_ALLOW_REDIRECTS` must be set to `true`. Its default is `false`, and on the default the affected fetch paths do not follow redirects at all, so a deployment that has not changed this setting is not affected.</p> <p>The attacker needs an authenticated account of any role, with access to any feature that causes the server to fetch a URL. Web search, ingesting a URL into a collection, the built-in page fetch tool and image URLs in chat all reach it. No internal hostnames need to be known, because the loopback and cloud metadata addresses are fixed and identical on every deployment.</p> <p>Neither `ENABLE_LOCAL_WEB_FETCH` at its default of `false` nor any set of entries in `WEB_FETCH_FILTER_LIST` prevents this.</p> <p>## Impact</p> <p>An authenticated user can make the server issue requests to hosts the operator deliberately excluded, and…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>Open WebUI protects server-side web fetches with two controls: the operator&#39;s list of excluded hosts, and a check that refuses private and internal addresses. Neither control was applied to the destination of an HTTP redirect. On a deployment where redirect following is enabled, any authenticated user who can cause the server to fetch a URL could submit a page that redirects, and the server would fetch the redirect destination without either control being applied to it. The server therefore connects to hosts the operator excluded, and to internal addresses including loopback, private networks and cloud metadata endpoints.</p> <p>## Preconditions</p> <p>`AIOHTTP_CLIENT_ALLOW_REDIRECTS` must be set to `true`. Its default is `false`, and on the default the affected fetch paths do not follow redirects at all, so a deployment that has not changed this setting is not affected.</p> <p>The attacker needs an authenticated account of any role, with access to any feature that causes the server to fetch a URL. Web search, ingesting a URL into a collection, the built-in page fetch tool and image URLs in chat all reach it. No internal hostnames need to be known, because the loopback and cloud metadata addresses are fixed and identical on every deployment.</p> <p>Neither `ENABLE_LOCAL_WEB_FETCH` at its default of `false` nor any set of entries in `WEB_FETCH_FILTER_LIST` prevents this.</p> <p>## Impact</p> <p>An authenticated user can make the server issue requests to hosts the operator deliberately excluded, and…</p> https://db.gcve.eu/vuln/pysec-2026-3878