Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| open-webui | pip | >= 0.9.5, <= 0.11.0 | 0.11.1 |
Miggo AIRoot Cause AnalysisThe vulnerability is a Server-Side Request Forgery (SSRF) in Open WebUI, identified as CVE-2026-88001. It allows an authenticated user to make the server issue requests to internal or explicitly blocked hosts. The root cause is the failure to apply security checks to the destinations of HTTP redirects when the AIOHTTP_CLIENT_ALLOW_REDIRECTS setting is enabled.
The system uses two primary security controls for outbound web fetches: a private-address check to prevent access to internal networks, and a configurable filter list (WEB_FETCH_FILTER_LIST) to block specific domains. Both controls were implemented in a way that they only inspected the initial URL provided by the user.
For requests made with the aiohttp library, the private-address check was implemented in a custom resolver, _SSRFSafeResolver. This check was bypassed entirely if the redirect destination was an IP literal, as aiohttp does not use a resolver in such cases. Functions like get_ssrf_safe_session and WebRetriever._fetch created aiohttp sessions using this flawed resolver, making them vulnerable.
For requests made with the requests library, the filter list check was performed only once in the validate_url function. The _SSRFSafeAdapter used for these requests did not re-evaluate the filter list for each redirect hop, allowing a bypass.
The patch addresses these issues by moving the security checks to a layer where they are executed for every request, including each hop in a redirect chain. For aiohttp, a new _SSRFSafeConnector is introduced that hooks into the connection process and handles IP literals. For requests, the _SSRFSafeAdapter is modified to include a send method that performs a check on every request. Additionally, the validate_url function is updated to use new helper functions (_assert_host_allowed, _assert_addresses_allowed) that ensure comprehensive checks are applied to both hostnames and resolved IP addresses, including those embedded in IPv6 addresses.
validate_urlbackend/open_webui/retrieval/web/utils.py
_SSRFSafeResolver.resolvebackend/open_webui/retrieval/web/utils.py
get_ssrf_safe_sessionbackend/open_webui/retrieval/web/utils.py
WebRetriever._fetchbackend/open_webui/retrieval/web/utils.py
_SSRFSafeAdapter.sendbackend/open_webui/retrieval/web/utils.py