Most recent entries from all

bdu:2026-07199

EUVD-2026-319101

fkie_cve-2026-45331

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, validate_url() in backend/open_webui/retrieval/web/utils.py calls validators.ipv6(ip, private=True), but the validators library does NOT implement the private keyword for IPv6 — the call raises a ValidationError (which is falsy in a boolean context), so every IPv6 address passes the filter. In addition, IPv4-mapped IPv6 (::ffff:10.0.0.1) bypasses the IPv4 check entirely, and several reserved IPv4 ranges (0.0.0.0/8, 100.64.0.0/10, 192.0.0.0/24, etc.) are not blocked. This vulnerability is fixed in 0.9.0.

GHSA-4v7r-f4w8-8972 — Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature

Affected: PyPI: open-webui

# SSRF Bypass via IPv6/IPv4-mapped IPv6/IPv4-reserved-ranges in `validate_url()`

## Summary

`validate_url()` in `backend/open_webui/retrieval/web/utils.py` calls `validators.ipv6(ip, private=True)`, but the `validators` library does NOT implement the `private` keyword for IPv6 — the call raises a `ValidationError` (which is falsy in a boolean context), so every IPv6 address passes the filter. In addition, IPv4-mapped IPv6 (`::ffff:10.0.0.1`) bypasses the IPv4 check entirely, and several reserved IPv4 ranges (`0.0.0.0/8`, `100.64.0.0/10`, `192.0.0.0/24`, etc.) are not blocked.

The vulnerability has existed since the `validate_url()` function was introduced and was NOT actually fixed by GHSA-c6xv-rcvw-v685 / CVE-2025-65958 despite that patch's intent. It affects every endpoint that calls `validate_url()`, including `/api/v1/retrieval/process/web`, `/api/v1/images/edit`, and others.

## Affected code

`backend/open_webui/retrieval/web/utils.py validate_url()`:

```python if validators.ipv6(ip, private=True): # ValidationError is falsy — never raises raise ValueError(...) ```

## Proof of concept

```python import validators print(validators.ipv6("::1", private=True)) # ValidationError(func=ipv6, args={'reason': "ipv6() got an unexpected keyword argument 'private'", ...}) ```

End-to-end exploit:

```python import requests, ipaddress

OPEN_WEBUI_URL = "https://target" TOKEN = "..." TARGET_IPV4 = "169.254.169.254" # AWS IMDSv1 mapped = "::ffff:" + TARGET_IPV4

requests.…

PYSEC-2026-2702 — Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature