7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54018

CVE-2026-54018: Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the SafePlaywrightURLLoader implements a validate_url function to prevent SSRF attacks by checking the IP address of the user-provided URL. However, this validation is performed only on the initial URL. Since Playwright automatically follows HTTP redirects (301/302) by default, an attacker can bypass the validation by providing a safe URL that redirects to a restricted internal network address (e.g., localhost, Docker container network, or Cloud Metadata). This allows the application to access internal services despite ENABLE_RAG_LOCAL_WEB_FETCH being set to False This vulnerability is fixed in 0.9.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54018

CVE-2026-54018:

7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
open-webui	pip	<= 0.9.5	0.9.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-jrfp-m64g-pcwv, is a Server-Side Request Forgery (SSRF) in the Open WebUI's Playwright-based web loader. The root cause is the application's failure to validate URLs after an HTTP redirect. The SafePlaywrightURLLoader class contains lazy_load (synchronous) and alazy_load (asynchronous) methods responsible for fetching web content. In vulnerable versions (<= 0.9.5), these functions would validate the initial user-provided URL but then use Playwright's page.goto() function, which follows redirects by default. This allowed an attacker to supply a seemingly benign URL that redirects to a private or internal IP address (e.g., 127.0.0.1, cloud metadata endpoints), bypassing the initial SSRF check.

The patch, found in commit f02aeea0bbd5fee6c223008baa7c0a28b1e98ac5, introduces request interception for all navigation events within Playwright. It adds new helper methods (_intercept_navigation_sync and _intercept_navigation) that re-validate the URL for every document request, including those initiated by redirects. The lazy_load and alazy_load functions were modified to register these interceptors using page.route() before calling page.goto(). Therefore, any attempt to exploit this vulnerability would involve a call to either SafePlaywrightURLLoader.lazy_load or SafePlaywrightURLLoader.alazy_load, making them the key indicators of exploitation in a runtime profile.

Vulnerable functions

SafePlaywrightURLLoader.lazy_load

backend/open_webui/retrieval/web/utils.py

This function loads a URL using Playwright. Before the patch, it only validated the initial URL and then called `page.goto(url)`, which by default follows HTTP redirects. An attacker could provide a valid URL that redirects to an internal or restricted address, bypassing the security check and leading to a Server-Side Request Forgery (SSRF) vulnerability.

SafePlaywrightURLLoader.alazy_load

backend/open_webui/retrieval/web/utils.py

This is the asynchronous version of `lazy_load`. It has the same SSRF vulnerability where it follows HTTP redirects without validating the destination URL, because it called `page.goto(url)` without an interceptor to check each navigation request.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.