CVE-2026-88001: Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEBFETCHFILTERLIST or private-address controls to HTTP redirect destinations when AIOHTTPCLIENTALLOWREDIRECTS was enabled. An authenticated user could redirect the aiohttp and requests fetch paths to excluded hosts, loopback, private networks, or cloud metadata services and route resulting content into web search, URL ingestion, page-fetch tools, or chat image processing. This issue is fixed in version 0.11.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.11.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user can exploit it when server-side web fetching follows redirects. The attacker needs to supply or cause a fetch URL that redirects to an excluded host, loopback address, private network address, or cloud metadata service.
Are default filtering controls sufficient to prevent exploitation?
No. In affected versions, WEB_FETCH_FILTER_LIST and private-address controls were not reapplied to redirect destinations when AIOHTTP_CLIENT_ALLOW_REDIRECTS was enabled.
Which features may expose fetched internal content?
Redirected content could be routed into web search, URL ingestion, page-fetch tools, or chat image processing. Systems using these server-side fetch paths are relevant to triage.
What should be done if upgrading is not immediately possible?
Disable redirect following by setting AIOHTTP_CLIENT_ALLOW_REDIRECTS so redirects are not allowed. This addresses the condition under which redirect destinations bypassed the filtering controls.
How can I determine whether my deployment is affected?
Deployments running Open WebUI from 0.9.5 until 0.11.1 are affected if they allow server-side web fetches to follow redirects. Version 0.11.1 fixes the issue.